5 Steps to Improve Your Software Supply Chain Security

Organizations that take control of their software supply chains will see tremendous gains in developer productivity, improved quality, and lower risk.

Derek Weeks, Vice President & DevOps Advocate, Sonatype

April 14, 2016

3 Min Read

To improve management of component vulnerabilities, consider these five steps which mimic a number of the supply chain management concepts originated by quality guru W. Edwards Deming to improve quality, accelerate feedback loops, and increase efficiencies of manufacturing operations. The same approaches are being adopted by organizations improving their own operations through the adoption of Continuous Delivery and DevOps processes:

  1. Create a software bill of materials for one application: Visibility into one application can help you understand your current component usage. A number of free and paid services are available to help you create a software bill of materials within a few minutes. The bill of materials will help you identify the unique component parts used within your application and the suppliers who contributed them. These reports list all components used, and several services also identify component age, popularity, version numbers, licenses, and known vulnerabilities.

  2. Take inventory within one of your local warehouses: Repository managers (aka artifact repositories) are commonly used by software development teams. Components residing in repository managers can easily be reused across software development. If outdated or defective components reside in the repository manager, they can easily make their way into multiple applications. Start by identifying a repository manager in use within your organization and creating an inventory of the parts cached there. Some repository managers automate this inventory reporting process for you, listing components, versions, licenses, and security vulnerabilities.

  3. Design approval processes to be frictionless, scalable, and automated: Manual reviews of components and suppliers cannot keep pace with the current volume and velocity of consumption. Your organization must not only define your policies for supplier and part selection but also find practical ways to enforce them without slowing down development or inadvertently encouraging workarounds. Policies must be agile enough to keep pace with modern development. Strive to automate policy enforcement and minimize drag on developers.

  4. Enable developer decision support: Developers are the primary consumers of components in software supply chains. Over 80% of an application today is composed of these components with the remainder being custom code. Help developers by automating the availability of security and quality data very, very early in the development lifecycle. By selecting the highest-quality software components early on and verifying the security hygiene of custom code, developer productivity can be improved by 30% as a result of eliminating unplanned, unscheduled work.

  5. Ensure visibility and traceability throughout the software lifecycle: Components can enter the software development lifecycle at many different places. Requests are initiated by developers and the tools they use regularly to build, integrate, and release applications. Since component selection is not a point-in-time event, continuous monitoring should be used to alert you when new and unchecked components have entered the supply chain. Alerts can also tell you when components used are out-of-date or when new vulnerabilities have been discovered. Continuous monitoring will also allow for component traceability, improving overall mean time to repair defects.

Related Content:

Gain insight into the latest threats and emerging best practices for managing them. Attend the Security Track at Interop Las Vegas, May 2-6. Register now!

Read more about:

Sponsor Resource Center

About the Author(s)

Derek Weeks

Vice President & DevOps Advocate, Sonatype

Derek Weeks is passionate about applying proven supply chain management principles to improve efficiencies, reduce security risks, and sustain long-lasting competitive advantages. He is a distinguished international speaker and lectures regularly on modern software development practices, continuous delivery and DevOps, and application security.
A 20-year veteran of the software industry, Derek has advised leading businesses on IT performance improvement, practices covering continuous delivery, business process management, systems and network operations, service management, capacity planning and storage management.

Derek currently serves as vice president and DevOps advocate at Sonatype, where he leads the largest and most comprehensive annual analysis of software supply chain practices to date across more than 150,000 development organizations.

Keep up with the latest cybersecurity threats, newly discovered vulnerabilities, data breach information, and emerging trends. Delivered daily or weekly right to your email inbox.

You May Also Like

More Insights