Software composition analysis and how it can protect your supply chain

What is software composition analysis?

Software composition analysis (SCA) provides automated visibility into all application components. An SCA tool automatically scans the application’s source code and provides an inventory of third-party, open-source, and internal components, including operating systems, frameworks and libraries.

Organizations use software composition analysis mainly to get an automated inventory of open source components and efficiently manage them. Otherwise, teams may need to manually go through every piece of code to identify all components — a painstaking and highly inefficient task. 

Learn Secure Coding

Build your secure coding skills in C/C++, iOS, Java, .NET, Node.js, PHP and other languages.

Learn More

What is supply chain risk?

Today, in-house developers don’t write all the code in an application. Software development teams build new products using existing building blocks such as open source components. This approach allows developers to produce software quickly by leveraging pre-built components.

The concept of a software supply chain is still new and has only become widespread in the last few years, although supply chains have existed since the dawn of the industrial revolution. For example, the automobile industry relies on complex supply chains with diverse parts from dedicated manufacturers. An automaker takes all these components to assemble a complete car.

The modern software industry applies the same process but without physical pieces. Apart from small amounts of custom code, everything is ready-made technology — existing libraries, packages and other pre-built components. Developers assemble these components to create a complete product ready to serve users. 

The build pipeline

The software supply chain describes a development method. Modern software development involves a build pipeline that is the software supply chain’s collection point, defining all the steps required to produce the software.

However, when developers Incorporate open source and third-party components into their software, the organization must accept the risks associated with the software they didn’t write. These risks are the central issue in the supply chain approach, affecting both cloud-based and internal applications. Any application delivered to the customers carries third-party risk.

Managing risk

Reusable software components are essential for fast, modern development pipelines, so organizations should not allow the risks to discourage the use of a supply chain. Managing supply chain risks involves understanding the hygiene and maintenance required to ensure secure, healthy applications and implementing automated security testing.

For example, many organizations erroneously view open source software as free, ignoring developers’ necessary actions to screen components for vulnerabilities. They must prepare for supply chain attacks that leverage advanced persistent threats (ATPs) to identify weak points in the software supply chain.

Usually, third-party applications and vendors provide the opportunity for attack. Once the attacker discovers the weak point, it can inject malware into the system, including Trojan horses, spyware, worms or viruses. The attacker might use this malware to modify the third-party code source to access the target organization’s data. Attacks can occur at any point in the supply chain.

How SCA protects the software supply chain

Recent large-scale breaches like Kaseya and SolarWinds have raised awareness of the software supply chain risks. Organizations must address the gaps in security controls and supply chain management that allows attackers to compromise applications and end-users. Attackers can infiltrate the application delivery pipeline, upload malicious software components to open source repositories and exploit existing open source vulnerabilities. 

Software supply chain security involves a multifaceted process, including identity and access management (IAM), security policies, code signing and tests.

One important aspect of protecting the supply change is software composition analysis (SCA). Historically, SCA helped organizations identify license-related risks and vulnerabilities in open-source libraries. It helps advise developers and security teams on upgrading components. 

Today, SCA vendors offer features for ensuring supply chain integrity. Many vendors embrace the role of a supply chain protector, introducing the following SCA capabilities:

1. Repository integration and component controls — integrating with binary and source code repositories allow the SCA solution to restrict the use of unsafe components based on corporate security policies. Some vendors offer browser plug-ins to notify developers of high-risk components and recommend alternatives.
2. Software bill of materials (SBOM) — governmental organizations and industry partners have established common SBOM proofs of concept and terminology. Many SCA vendors directly provide SBOM in the user interface, although some vendors depend on external tools to support SBOM. Some providers support SBOM formats like Software Package Data Exchange, not only CSV and PDF. 
3. Protection against dependency confusion attacks — a dependency confusion attack involves prioritizing dependencies in a public package over the dependencies in a private package with the same name. These attacks have affected several major tech companies. Some SCA providers offer dependency confusion protection features and integrity checks, such as describing the source location of dependencies.
4. Discovering compromised open source components — attackers often post malicious components to popular open source repositories, poisoning the software supply chain. Several SCA vendors offer a proactive approach, using research teams and tools to discover and eradicate malicious components from open-source repositories to prevent unwitting developers from downloading them.

Learn Secure Coding

Build your secure coding skills in C/C++, iOS, Java, .NET, Node.js, PHP and other languages.

Learn More

SCA solutions and the chain supply

Here are four ways in which SCA technology can protect the supply chain:

1. Integrating with binary and source code repositories, detecting and blocking unsafe components.
2. Creating a Software bill of materials (SBOM), which provides visibility over the content of software packages.
3. Preventing dependency confusion attacks by preventing the use of malicious private packages with the same name as the public package.
4. Detecting malicious open source components in repositories prevents developers from downloading and using them.

I hope this will be useful as you improve the security posture of your software development process.