Software Supply Chain

Microsoft has published a paper on Best Practices for a Secure Software Supply Chain.  https://docs.microsoft.com/en-us/nuget/concepts/security-best-practices

You should not be surprised that it says Caveat Emptor.  It is all about how the buyer of software must manage the risk of any corruption in the supply chain.  It is silent on the supplier's, e.g., Microsoft, responsibility.  It simply assumes that some supplier in your supply change will ship you corrupt code, essentially with no accountability.

The issue first gained notice when a supplier, SolarWinds, having failed to manage the content of its product, shipped malicious code to all of its customers.  It's response, like that of Microsoft, was "Y'all be ca'ful, heah."  

Suppliers must be held accountable for all the code that they ship.  We have become so accustomed to poor quality code, and the huge cost of "patching" that comes with it, that this idea seems somehow foreign.  However, this issue is about code content, not quality.  

I do not propose to so reform the market that suppliers would be held accountable for implementation induced vulnerabilities in their code, for its suitability for its intended use, for its merchantabiity.  I only want them to be held accountable for malicious code, whatever its source, that they ship.  Managing the content of one's product, where it came from, may be related to, but simpler than that of ensuring that it is free of dangerous errors.  

I recently asked a colleague, a famous attorney, partner in a prestigious Washington law firm, why he thought that SolarWinds had not been sued for its gross negligence?  His answer was that the injured parties were enterprises, that they did not see themselves in the role of plaintiff.  

So called "software engineers" must be held accountable to the same standards that we hold all other "engineers."  Suppliers in the software supply chain must the held to the same standards as we hold other suppliers.  Software should not be synonymous with dangerous.  

2021 The Cybersecurity Disaster Year

 2021 has proved to be a disaster year for Cybersecurity.  Events have demonstrated just how porous our cyber infrastructure is.  Perhaps for the first year in history, compromises have grown faster than the increase in use, uses, and users might have suggested.  

CISA, the FBI and the NSA have warned in a joint advisory that Russian threat actors are actively exploiting and seeking to cause disruption to IT and OT networks, especially around critical infrastructure. The advisory outlines technical details of at least 18 vulnerabilities and malware attacks.

It may well have been worse than we know.  We know that many, not to say most, of our systems were vulnerable, to the corrupt supply chain (e.g. SolarWinds) or to vulnerable open source software (e.g. log4j), at least for the time it took us to appreciate and mitigate the exposures.  Few of us know that that window of opportunity was not used to covertly install backdoors into our networks for later exploitation.  It is at least possible, not to say likely, that hostile forces took the opportunity to stockpile compromises that they did not immediately have the motive or resources to exploit.  

it seems unlikely that our adversaries, particularly nation states, missed the opportunity presented to them by these exposures.  SolarWinds was an attack, planned and resourceful.  While we can identify and remove the SolarWinds code, it is near impossible to know about,  identify, or remove covert back doors installed using it.  

How can we mitigate the risk that such covert backdoors represent?

First, we must implement process-to-process isolation.  We can no longer operate a flat enterprise network.  We must structure the network so as isolate high risk applications, such as user owned devices, browsers, and e-mail, from sensitive data and services.  We can do this in part physically structure in the network, and in part by end-to-end application-layer cryptography.

We must implement strong process-to-process authentication ("zero trust") not just horizontally, that is system to system, but also vertically, up and down the stack. For example, the application must authenticate the database manager and the database manager must authenticate the application processes that use it.  It is urgent that we isolate covert compromises, backdoors, and vulnerabilities, before they are exploited and so that they do not put the entire enterprise at risk. 

Second, we must implement a policy of "least privilege."  While such a policy involves somewhat more administrative burden than the all too common laissez faire policy, security does not need to be free to be efficient.  It must only be cheaper than tolerating the risk.  If the covert backdoor has no privileges, it can do no harm.  

Third, we must demand that software come with a digital bill of materials.  When a vulnerability is found in widely used software, we must be able to quickly determine whether or not and where, we may have instances of that vulnerable software installed.  We should not have to beat the bad guys at scanning for the vulnerability.

Fourth, we must hold developers and suppliers of products that include software responsible for the content of that software, if not for its quality, at least for any malicious code which they ship.  While we may tolerate poor quality software and the now expensive patching regime forced on by that poor quality, that is not the same as tolerating malicious code which the supplier did not even write.    

I am tempted to go on but I want you to focus on the first and second.  These are policies that are specifically implicated by the risk that our networks are already compromised but they are not limited to that risk.  They are efficient because they address the entire range of cyber risks.