Article

Category: Expert stories

Best practices in Software Supply Chain Security 

In this article, software architect Mateusz Pruchniak presents key practices in software supply chain security that allow organizations to minimize the risk of security gaps and threats related to software delivery.

Mateusz Pruchniak, Warsaw

The software supply chain is the 'process of delivering a product to the customer' in the IT domain, referring to the process of designing, building, delivering, and maintaining.

Software supply chain security is a crucial aspect of the contemporary IT world. As technology evolves, an increasing number of organizations and businesses rely on software delivered from various sources, which creates gaps in its security posture.

This article will discuss various aspects of software supply chain security, starting from securing source code to securing deployment processes. I will present software supply chain security practices divided into 5 stages.

 

Attack on Sunburst

The IT world paid significant attention to supply chain security after the high-profile attack on SolarWinds, known as Sunburst. It was one of the most serious cyber incidents and took place in December 2020.

The attack began by compromising the infrastructure of the software provider SolarWinds to inject malicious code into the popular SolarWinds Orion software, responsible for monitoring and managing computer networks.

supply-chain-security_body-image-2

It was a sophisticated and complex attack that led to security breaches in many critical institutions, including governments, companies, and organizations worldwide. The infected software version was installed for over 18,000 customers.

The insecurity of the software supply chain can lead to serious consequences, such as data breaches, user privacy violations, critical system disruptions, and a negative impact on a company's reputation. As a result, developing and implementing best practices in security has become an essential element of technology-based business strategies.

 

Securing Source Code

The foundation of every software supply chain is its source code. The code repository should be treated as a standard production system and secured in the same manner, considering the principle of least privilege and separation of duties.

Recommended practices:

  1. Enable MFA (Multi-Factor Authentication) for accessing the SCM (Source Code Management) system - multi-factor authentication should be required and enforced to add an extra layer of security.
  2. Use SSH keys to grant developers access to the source code repositories - Instead of relying on login/password credentials, which are susceptible to typical hacking techniques such as brute force attacks or password guessing, it is recommended to use SSH keys or SSH certificates. If not possible, consider using frequently rotated access tokens as an alternative.
  3. Require signed commits - signing the source code (commits and tags) ensures integrity, non-repudiation, and auditability. The most popular mechanisms for signing are GPG-based mechanisms, although S/MIME certificates are also used for this purpose.
  4. Enable or implement change scanning and blocking mechanisms - Block the ability to save passwords, certificates, keys, and tokens in the code repository to prevent accidental exposure of sensitive information.
  5. Separate responsibilities and duties between distinct teams - Separate the teams responsible for modifying the source code from the administrators responsible for configurations, validations, and policies imposed on the code repository.
  6. Enforce code review before merging changes (Pull Request, Merge Request). The author(s) of the changes should not be the same person approving the changes (four-eyes principle).
  7. Regularly perform backups - make backups of the code and store them in a secure location. Backups can be used by verification tools to ensure the repository's integrity.

 

  The insecurity of the software supply chain can lead to serious consequences, such as data breaches, user privacy violations, critical system disruptions, and a negative impact on a company's reputation.

 

Illustration of a solid chain with code written in the metal

Securing Dependencies

Dependencies on external libraries are an integral part of the software building process. However, they also come with certain challenges, such as managing library versions, ensuring that libraries are secure and up-to-date, and identifying and resolving conflicts between different libraries.

Recommended practices:

  1. Verify the source of external libraries - before using an external library, it is essential to verify its authenticity and origin. It is best to obtain libraries from official sources, such as official websites, official repositories, or other reputable distribution channels. A good practice is to copy dependencies to a secure, protected private repository. 
  2. Verify integrity - ensure that downloaded libraries have not been modified during transport or download. Verifying the checksum can help ensure that the downloaded library is identical to the original file. 
  3. Verify vulnerabilities - before using an external library, it is worth conducting an analysis of potential vulnerabilities that may exist in a given version of the library. There are specialized tools for automatically scanning libraries for known vulnerabilities, such as SAST (Static Application Security Testing) tools or OWASP Dependency-Track. 
  4. Monitor vulnerabilities - it is valuable to keep track of current security information related to the used libraries, such as notifications about detected vulnerabilities and the availability of fixes. This way, potential threats can be quickly addressed, and updates can be applied. 
  5. Verify licenses - remember that security is not the only aspect to consider. Legal aspects are also essential. Software often utilizes open-source or commercial libraries, which are available under various licenses. It is crucial to meticulously verify the licenses of these libraries or other dependencies. 

 

  Security is not the only aspect to consider; legal aspects are also essential. Software often utilizes open-source or commercial libraries, and it's crucial to meticulously verify the licenses of these libraries or other dependencies.

 

Securing Build Pipelines

Securing the compilation and build processes of software is a fundamental element of ensuring the security and integrity of the final software product. At this stage, the software is compiled or built from source code and external dependencies. Incorrect and insecure configurations can undermine all the efforts made to secure the source code and external dependencies.

Recommended practices:

  1. Secure the infrastructure - the infrastructure used for compilation and building should be secured in the same way as the production infrastructure. Applying production-like controls will protect against unauthorized changes to the infrastructure (four-eyes principle), unauthorized configurations, and ensure monitoring (SIEM), update processes, and vulnerability scanning. 
  2. Minimize infrastructure sharing - shared infrastructure (e.g., virtual machines) can lead to vulnerabilities in one technology being exploited to compromise the compilation or build process of other software. The best practice is to use pre-prepared, secured container images for one-time execution of the process and then delete them after use. Images should contain only the necessary tools and binaries required for the specific process they are responsible for, as well as the narrowest range of permissions and network access. 
  3. Store pipeline configurations as code - configuration should be implemented as code and treated as immutable ("pipeline as code"). Apply the same practices as mentioned above for source code. 
  4. Include tests and quality gates - add automated software quality assessments at various stages of the pipeline. Quality gates can be configured and tailored to the specific project's needs and organizational requirements. 
  5. Sign output and intermediate artifacts - to ensure integrity and repeatability of the process and artifacts, each individual step in the process requires signing. The set of signatures is included in the final artifact package, ensuring the integrity of the entire artifact and its related metadata. 
Artboard 3

Securing Artifacts

Dependencies on external libraries are an integral part of the software building process. However, they also come with certain challenges, such as managing library versions, ensuring that libraries are secure and up-to-date, and identifying and resolving conflicts between different libraries.

Recommended practices:

  1. Verify artifact signatures - verification of artifact signatures should occur at the moment of adding the artifact to the repository. This ensures that only trusted and signed artifacts are allowed in the repository.
  2. Limit access - restrict access to the artifact repository only to individuals who require it. Utilize strong password-based authentication, SSH keys, or certificates.
  3. Segregate responsibilities - implement the principle of Separation of Duties to separate responsibilities for the artifact repository to avoid conflicts of interest, abuses, and limit the risk of potential threats. Regular monitoring and review of assigned permissions are also crucial. 
  4. Regularly backup - create backups of the artifact repository and store them in a secure location. Ensure that data recovery procedures are tested and accurate. 
  5. Audit access - monitor and log attempts to access the artifact repository. Review logs to identify suspicious activities and unauthorized access attempts, especially on modification operations outside the automated process. This helps detect and respond to potential security breaches promptly. 

 

The deployment pipeline should be designed in a way that enables automatic and controlled deployment of artifacts, while maintaining the highest security standards.

 

Securing Deployment Pipelines

Having a secure source of trusted artifacts (meaning that we store trusted and verified software) requires developing a secure deployment pipeline for these artifacts to various environments, including production environments. The deployment pipeline should be designed in a way that enables automatic and controlled deployment of artifacts, while maintaining the highest security standards.

  1. Segregate environments - implement environment segregation to keep non-production and production environments separate. Limit access to production only to authorized personnel, reducing the risk of introducing errors into the production environment. 
  2. Segregate responsibilities - similar to previous steps, individuals responsible for deploying software to the production environment should be independent of those responsible for developing and testing the software. 
  3. Automate - use tools for automated software deployment from trusted artifact sources, and validate artifact integrity through signature verification. 
  4. Monitor and log - monitor the deployment process and log information for auditing and informational purposes. 

Read also:
Cybersecurity in the age of phishing - how you get tricked

Ready to grow?

Get help with your CV and profile and be found for rewarding projects.

Register your profile

Blog

Read more

See insights

left-arrow
right-arrow

Expertise strategy

The rise of sustainability-linked loans

In this article, Jesper Diget, CPO at emagine, explores how linking sustainability initiatives to the bottom line is reshaping business strategies.
Expertise strategy

How to keep teams productive in the hybrid working era

Martin Hartley, CCO of emagine, shares insights on successful hybrid working through balancing in-person collaboration, creating team synergy through the use of virtual tools, and supporting individual productivity patterns.
Expertise strategy
Trends

Business trend in 2025: Urgency for CEOs to take back IT ownership to drive growth

Dive into the evolving role of technology in business growth and explore the strategies leaders are using to balance outsourcing and insourcing, all while navigating the challenges of a dynamic, tech-driven landscape.
Expertise strategy

Possibilities and risks for Germany as a modern tech nation

This article explores Germany’s digital challenges, where gaps in skills and tech adoption risk its global competitiveness despite a strong industrial base and top technical universities.
Expertise strategy
Strategy, change & transformation

Using AI to streamline resource allocation

As global digital transformation spending heads toward $3.9 trillion by 2027, this article explores an AI resource allocation case from emagine HQ, other AI optimizations, and common challenges.
Data & Analytics
Expertise strategy

AI and the Ethics Tango

Discover the evolving relationship between humans and advanced technologies. Our article delves into the ethical considerations and risks associated with modern machines, highlighting how the complexity of today’s tech goes beyond simple utility.
Expertise strategy
Risk & Compliance

How to enhance cybersecurity measures

Enhance cybersecurity measures with updated systems, training, and secure remote work practices to protect your business. Explore here.
Expertise strategy
Training

The future of workplace upskilling and training

This article examines the importance of workplace upskilling, current trends, and how technological advancements will shape the future of workplace learning.
The agile transformation of a large enterprise is a complex process that requires profound changes in leadership, structure, and corporate culture.
Expertise strategy
Projects & Implementation
Tech & Development

Developments of AI in Project Management

This article discusses how the integration of artificial intelligence (AI) and machine learning (ML) into project management is driving a cultural shift towards innovation and agility within organizations.
Consultants assessing regulatory documents
Expertise strategy
Risk & Compliance

What is NIS 2 and how should businesses prepare?

With increasing cyberattacks, organizations must prioritize compliance, improve cyber hygiene, and implement standards like ISO/IEC 27001 to build resilience and reduce risks. Learn what NIS 2 is and how businesses should prepare for this comprehensive European cybersecurity directive.
Expertise strategy
Risk & Compliance

The future of preventing Financial Economic Crime and the importance of KYC

Understanding KYC protocols, AML regulations, and broader financial crime trends is vital for maintaining financial integrity. This article discusses key developments in compliance, KYC, and AML.
Data & Analytics
Expertise strategy
Tech & Development

New EU Act on Artificial Intelligence

Learn the ins and outs of the world’s first comprehensive legal framework on AI, the new EU AI Act and its anticipated impact on businesses.
Illustration of a solid chain with code written in the metal
Expertise strategy
Risk & Compliance

Digital Operational Resilience Act (DORA)

Here’s everything you need to know about the Digital Operational Resilience Act (DORA) which will apply from 17th January 2025.
Expertise strategy
Risk & Compliance

Proposed Code of Practice on cybersecurity governance

Explore the UK Government’s latest draft on cybersecurity governance Code of Practice together with emagine’s expert, Trine Øksnebjerg.
A business consultant ready to give a presentation at work.
Expertise strategy
Strategy, change & transformation

Embracing change as an opportunity for growth

In this article, we outline the best practices when it comes to navigating organizational change, including how to tackle challenges and maintain a clear vision when unprecedented issues arise.
Modern business environment with a man and woman in front of window facing a city
Expertise strategy

People-centric leadership: Tips for fostering digital wellbeing at work

This article equips team leaders with strategies for fostering digital wellbeing in the workplace, empowering them to guide their teams through the challenges that come with prolonged screen-time, hybrid work, and other factors of digitalisation in a modern workplace.
Expertise strategy
Strategy, change & transformation

Empower your teams through strategic thinking

This article considers why strategic thinking is crucial to effective leadership and explores some practical ways for leaders at all levels to develop this skill.
Consultants and advisors i an office space seen from above
Expertise strategy
Trends

Insights into 2024 business trends

With 2023 behind us and eyes fixed firmly on what opportunities 2024 will bring, Gillian Whelan, Country Manager of emagine Ireland, outlines five trends that will affect businesses this year.
Female consultant standing and writing on a desk
Expertise strategy
Risk & Compliance

Steering AML challenges: Embracing technology for a seamless future

Discover how to navigate AML challenges with automated processes and fortify your organization’s integrity and operations.
Bestshoring
Data & Analytics
Expertise strategy

Poland: An AI Centre of Excellence

AI is reshaping industries globally, and Poland’s thriving ecosystem positions it as a leader in AI development. emagine’s Cloud Administrator explores why Poland is a powerhouse in AI.
Business consultants conducting a meeting
Expertise strategy
Managed Teams & Managed Service
Staff augmentation

Managed Resourcing Services vs. Traditional Staff Augmentation

In the ever-evolving landscape of business operations, companies are constantly looking for ways to optimise their workforce strategies. Explore the two popular approaches that have gained prominence: Managed Resourcing Services (MRS) and traditional staff augmentation.
Expertise strategy
Risk & Compliance

Programme Governance: Top tips for success

In this article, we share some tips to navigate the intricate landscape of orchestrating interconnected projects and activities within a strategic framework.
Project manager at a meeting with his team.
Expertise strategy
Projects & Implementation

What has changed in PMBOK 7?

PMBOK is regularly updated to accommodate new trends, best practices, and developments in the field. How much has it changed between editions?
A team leader in front of her team
Expertise strategy
Projects & Implementation

The importance of leadership skills in a Project Manager

Behind every successful project lies a competent and visionary leader. In this article, we delve into the undeniable importance of leadership within project management and explore how effective leadership can be the driving force behind achieving project objectives.

Advisory & Solutions
Expertise strategy
Strategy, change & transformation

Building your PMO – Influence and Position

There are a number of things to consider when introducing a PMO. The Project Management Office fails far too often because of the wrong approach, and it can only be successful in the long term if fundamental questions are considered at an early stage.
Doug Collyer is Country Manager in UK
Expertise strategy
Strategy, change & transformation

The Nordic way of working: how does it help emagine consultants optimise their clients’ operations and boost profits?

emagine’s Nordic way of working embraces different perspectives and approaches to solve challenges and power progress among our consultants. Learn how our experts and Nordic work style can optimise our client’s operations and profitability.
thre people in a amicable meeting
Expertise strategy
Staff augmentation

Good onboarding: Setting your external workforce up for success

Enabling new consultants seamlessly integrate into your organisation is critical to their success. To ensure a smooth onboarding process, it is essential to help them get started immediately. This article will guide you through the most critical aspects of getting a consultant to start delivering from day one.
External consultants at a meeting in the office.
Expertise strategy
Staff augmentation

4 signs you need an IT consultant

Are you wondering if your company could benefit from hiring an IT consultant? This article outlines four common signs that indicate you may need external expertise to manage change, mitigate risk, or meet tight deadlines.

Bestshoring
Expertise strategy
Nearshoring
Publications

The Ultimate Guide to Nearshoring

Get our ultimate guide on how your IT organization can tap into Polish IT talent. Download the e-book and read condensed knowledge, facts and cases about Nearshoring based on our 12 years experience. Download now and get it free.
Expertise strategy
Tech & Development

The Complete Guide to Migrating Monolithic Applications to Microservices on the Cloud

As organizations strive to deliver high-quality software and services at scale, many are turning to a microservices architecture as a way to break down monolithic applications into smaller, more manageable components.
Modern business environment with a man and woman in front of window facing a city
Expertise strategy
Staff augmentation

The Science behind hiring the top 10%

As a business and technology consulting firm, we live of our ability to recruit the very top talent for our business. In this piece, I would like to share our thoughts behind the approach we on emagine UK. We call it: The science behind hiring the top 10%.

Expertise strategy
Strategy, change & transformation

People hate change, so how do you best implement it?

Bringing in new technology, individuals, or new teams to work on a key project can feel like a threat to existing staff – but it doesn’t have to be that way if you manage change positively.
Expertise strategy
Strategy, change & transformation

Key Success And Failure Factors Of The PMO

In this article, we will delve into Project Management Office (PMO) overview, and we will help you decide if it may be convenient for your team to have a PMO.
IT professionals outside engaging in conversation
Bestshoring
Expertise strategy
Nearshoring

Poland, the IT hub of Europe?

Poland has become a European talent hub in technology and engineering, and European companies leverage polish talent coding skills for nearshoring projects. Learn why.
Business woman talking to two colleagues
Expertise strategy
Staff augmentation

Team extension: How to hire external consultants successfully

Hiring external consultants isn’t something you should treat lightly. Learn the most satisfactory way to leverage experts in your organisation. In this article, Senior Account Manager Jytte Raahede shares her tips on onboarding consultants successfully.
Four professionals sitting together in a positive meeting smiling
Bestshoring
Expertise strategy
Nearshoring

A short guide to succeeding with Nearshoring

For many companies, the decision to go nearshore is not an easy one. It’s a decision that requires a great deal of consideration – we know that because several of our current clients were also reluctant to go nearshore at first. Learn our tips on how to get it right.