Risk-adjusted secure software supply chain for a resilient application

The existing set of processes and technology investments made by product teams and the necessary evolutions in it can help the teams embed security across the board. A good place to start for most teams would be the use of NIST’s Secure Software Development Framework. This framework helps software developers reduce the number of vulnerabilities in a software and lower the potential impact of the exploitation of undetected or unaddressed vulnerabilities. It also addresses the root causes of vulnerabilities to prevent recurrences. This framework is based on four key pointers. 

• Preparing the organization to adopt practices to perform secure software development at the organization level.
• Protect the software from tampering and unauthorized access.
• Producing well-secured software that has minimal security vulnerabilities
• Respond to vulnerabilities identified within the application or its hosted environment

Furthermore, engineering teams should consider adopting a metrics-driven approach while delivering software. These metrics should help product teams gauge the effectiveness of their organization’s performance. These should check the following:

• Lead time taken for code commit changes to be released into production environments
• Mean time to restore a service or a functional component of the overall system
• The periodicity of deploying code to production or an organization releasing it to end users The percentage of changes to production or released to users result in degraded service and subsequently requires remediation 

Unless product engineering teams employ these pertinent measures, they will end up fighting an uphill battle without making real gains and fall short of achieving their objective of scaling security at the same relative speed of application delivery.

In modern software delivery, where application developers can choose from over 37 million open-source components, growing at 73% y-o-y, EY believes that product engineering teams should consider employing a ‘risk-adjusted secure software supply chain’. 

Security by design

The crux of a risk-adjusted secure software supply chain is that application developers, operations engineers and security analysts are equally responsible for building an anti-fragile, highly reliable software that is ‘secure by design’. For this, product engineering teams should consider the following quintessential building blocks to help deliver resilient applications.

Measuring security posture: Security posture of an application should be measured and maintained continuously. Also, the comprehensive risk posture of an application architecture running in production, including all its services, libraries, APIs, dependencies, attack surfaces, and sensitive data flows, should also be measured. The team should be allowed to rapidly identify and prioritize top business-critical risks that exist in applications at any point in time. The process of determining business risk should be automated. 

Quantify and protect SBOM: The team should assess the security and trustworthiness of third-party libraries and dependencies used within the application code. Proprietary code should be secured through period scans and architecture review and should be continuously tested and monitored after the deployment to identify any vulnerabilities. The developing team also correlates design level threats and security vulnerabilities identified in later stages of development to establish reliable feedback loops for better decision making.

Establish transparency: Transparency can be established through the visibility of software systems. An observability system integrates logging, monitoring, and analytics systems to help detect problems in real-time and troubleshoot them. It will also generate an event with a context that will help easily decide the response to the event. The team should collect relevant metrics, events, logs and traces of applications and its underlying components, such as containers, clusters, pods, and other intricate components. Set the context to show inter-service communication that will help in tracing to understand acceptable behavior. Automated agents can be deployed to detect abnormal behaviors and take corrective actions if necessary. 

Caption: Application Visibility Engineering helps report all sensitive data flows within an application, down to the columns and tables that are being accessed by individual services or APIs within a given application architecture.

A secured application

Leveraging these key facets will help product teams contextualize business risk in real time, for the various internal technology components within the applications during development. Thus, the limited availability of security skills does not become a bottleneck for the entire team in ensuring security but guarantees that all relevant stakeholders get to voice their opinions in a constructive manner.

This approach of leveraging a “risk-adjusted secure software supply chain” helps product engineering teams focus only on the top business critical risks, rather than digging the endless rabbit hole of false positives and toolchain noise. Furthermore, it builds greater trust within the team as developers, those in operations and security analysts have a clear understanding of the software bill of materials and optimized security checklists that are tuned for automation. This eventually helps in lowering the overall technical debt across the board, thus creating a path to sustainable and incremental approach to building and delivering rugged applications that are resilient.

Rakesh Anand, Director and Sudarshan Narayan, Senior Manager Technology Consulting, EY India also contributed to this article.