As we reflect on the software landscape of 2023, the overarching theme that defined the year was the growing emphasis on securing the software supply chain. ActiveState users found themselves at the forefront of this evolution, grappling with new challenges and adopting innovative strategies to safeguard their systems. In this comprehensive year-in-review blog, we delve into the key trends and issues that shaped the software supply chain landscape in 2023.
SLSA & SBOMs Take Center Stage
One of the pivotal developments in 2023 was the widespread adoption of the Software Bill of Materials (SBOMs) through Supply-chain Levels for Software Artifacts (SLSA) as a critical component of secure software development. SLSA provides a comprehensive inventory of the components and dependencies within a software project, offering transparency and traceability throughout the supply chain.
The industry is recognizing the importance of SLSA in mitigating the risks associated with third-party dependencies. By maintaining a clear record of software components and their origins, organizations gained the ability to quickly identify and respond to potential vulnerabilities or compromised components. This proactive approach to supply chain security marked a significant shift in the industry, moving away from reactive measures toward a more preventative and transparent model.
Learn more: Introducing SLSA 1.0: Securing the Code You Import & Build
Attestations: Building Trust in the Supply Chain
In 2023, the demand for trust and transparency in the software supply chain led to the rise of attestations. These cryptographic statements, signed by trusted entities, verified the integrity and security of software components. Attestations served as a powerful tool for DevSecOps teams, allowing them to establish and maintain a chain of trust throughout the development lifecycle.
By leveraging attestations, organizations could confidently assess the security posture of their software dependencies. This not only streamlined the process of vetting third-party components but also facilitated communication and collaboration across the software supply chain. The ability to verify the authenticity and security of each component provided a level of assurance that was crucial in an era marked by increasing cyber threats and sophisticated attacks.
Learn more: ActiveState Software Attestations Early Access Wrap Up
Disinformation: An Open Source Problem
While the industry made strides in securing the software supply chain, 2023 also brought attention to a less-discussed but equally critical issue: disinformation in open source projects. As collaborative development models gained prominence, so did the potential for malicious actors to introduce misinformation, intentionally or otherwise, into widely used open source projects.
Open source developers across the world found themselves grappling with the challenge of discerning genuine contributions from deceptive ones. The spread of disinformation could lead to the inclusion of compromised code, backdoors, or other security vulnerabilities in software projects, posing a significant threat to the integrity of the entire supply chain.
Addressing this issue required a multi-faceted approach, combining technological solutions, community-driven initiatives, and increased awareness. DevSecOps practitioners began actively participating in open source communities, implementing robust code review processes, and developing tools to detect and mitigate the impact of disinformation within their software supply chain.
Learn more: Disinformation is an Open Source Problem
SBOMs Mandated by the FDA
In a world increasingly reliant on interconnected software, the importance of secure software supply chains cannot be overstated. As we reflect on the transformative year of 2023, our blog sheds light on the pivotal role of Software Bill of Materials (SLSA) and attestations in fortifying the DevSecOps arsenal. Just as the medical field recognizes the criticality of the Software Bill of Materials in ensuring the safety and reliability of medical devices, the broader software industry is embracing these measures to secure its digital infrastructure. Our journey through the highs and lows of 2023 underscores the universal applicability of these principles, transcending industry boundaries to create a robust and resilient foundation for software development and deployment.
For those navigating the intricate landscape of software security, the insights provided in our blog offer a compass through the challenges of disinformation in open source projects and the looming threat of zero-day vulnerabilities, such as those faced by Perl enthusiasts. As we explore the parallels between the medical device industry’s adoption of SLSA and the broader software ecosystem’s commitment to supply chain security, our blog serves as a beacon for DevSecOps practitioners seeking actionable strategies and best practices. Join us on this gripping journey through the highs and lows of 2023, and discover how the lessons learned can empower you to face the ever-evolving challenges of securing the digital frontier.
Learn more: SBOMs for Medical Devices – Everything You Need to Know
Perl Zero Day Security Threats
A noteworthy security concern that emerged in 2023 revolved around Perl, a versatile programming language widely used in various domains. The Perl Steering Committee has recently identified and patched two new major vulnerabilities that affect the Perl core, both of which make it possible for hackers to execute malicious code. While perl.org has made available patched recent versions of Perl (v5.34, v5.36 and v5.38), older versions are also affected, increasing the risk of running any version of Perl prior to v5.34.
For this reason, ActiveState has taken the initiative to backport the security fixes for these vulnerabilities as far back as Perl v5.22. ActiveState has been supporting Perl for more than twenty years, originally via our legacy prebuilt distributions (ActivePerl Community Edition) and now via our more secure and up-to-date ActiveState Perl. Whether you require support during your upgrade process, or have decided to continue running an EOL version of Perl, contact us to see how ActiveState can help.
Learn more: Perl Zero Day Security Threats
The Way Forward: Continuous Improvement
As we step into 2024, the insights gained from the triumphs and tribulations of 2023 provide a roadmap for continuous enhancement in secure software supply chain practices. The industry’s commitment to cultivating robust and secure software supply chains is underscored by the emphasis on Software Bill of Materials (SBOMs), attestations, and the concerted effort to counter disinformation within open source projects.
In 2024, we see the evolving threat landscape that necessitates a steadfast commitment to adaptability and foresight. The pillars of continuous monitoring, automated testing, and proactive collaboration within the expansive software community are pivotal in the perpetual endeavor to bolster the software supply chain against emerging threats.
In retrospect, 2023 stands out as a transformative year for open source, characterized by an intensified focus on supply chain security, widespread adoption of SLSA and attestations, and the acknowledgment of disinformation as a critical challenge in open source environments. By confronting these challenges head-on and instilling a culture of perpetual improvement, In 2024, we will continue to help developers position themselves strategically to navigate the intricacies of the ever-evolving software landscape in the years ahead.
What’s Next?
Start 2024 off right by reading our Journey to Software Supply Chain Security eBook. Go from Anarchy to Nirvana.
