Comparação de abordagens de proteção à cadeia de suprimento de software

• Carlos Eduardo Miranda Zottmann ^[1] ; João José Costa Gondim ^[1] ; Thiago Melo Stuckert do Amaral ^[1] ; Edvan Gomes da Silva ^[1] ; Rafael Rabelo Nunes ^[2]
  1. [1] Universidade de Brasília

     Universidade de Brasília

     Brasil

     
  2. [2] v
• Localización: RISTI: Revista Ibérica de Sistemas e Tecnologias de Informação, ISSN-e 1646-9895, Nº. Extra 70, 2024, págs. 657-675
• Idioma: portugués
• Títulos paralelos:
  • Comparison of Software Supply Chain Protection Approaches
• Enlaces
  • Texto completo (pdf)
• Resumen
  • português

    A cadeia de suprimentos de software é um vetor de ataque em crescimento para incidentes cibernéticos complexos. A proteção contra ataques dessa natureza ainda é um problema em aberto para a comunidade internacional. Existem diversas abordagens definindo controles de segurança para mitigar riscos nas etapas da cadeia de suprimentos, porém não existe uma visão holística sobre essas abordagens. Esse estudo realiza um levantamento de taxonomias relativas ao tema e uma análise das abordagens de maneira a conseguir destacar as características e proporcionar uma melhor visibilidade da aplicabilidade dos controles propostos. Por fim, são providas comparações entre as abordagens com o intuito de fornecer insumos para organizações que desejam robustecer sua cadeia de suprimentos de software.

  • English

    The software supply chain is a hot spot for complex cyber incidents. Protection against such attacks is still an open problem for the international community. There are several approaches defining security controls to mitigate risks in the supply chain stages, however there is no holistic view of these approaches. This study carries out a survey of taxonomies on the subject and an analysis of the approaches to highlight the characteristics and provide better visibility of the applicability of the proposed controls. Finally, comparisons between approaches are provided with the aim of providing input for organizations wishing to strengthen their software supply chain.

• Referencias bibliográficas
  • Boyens, J., Smith, A., Bartol, N., Winkler, K., Holbrook, A., & Fallon, M. (2022). NIST - Cybersecurity Supply Chain Risk Management Practices...
  • Center for Internet Security (CIS). (2022). Software Supply Chain Security Guide. https://www.cisecurity.org/terms-of-use-for-non-member-cis-products/
  • Cloud Native Computing Foundation. (2021). Software Supply Chain Best Practices. https://project.linuxfoundation.org/hubfs/CNCF_SSCP_v1.pdf
  • Enduring Security Framework. (2022a). Securing the Software Supply Chain - Recommended Practices Guide for Customers. https://media.defense.gov/2022/Nov/17/2003116445/-1/-1/0/ESF_SECURING_THE_SOFTWARE_SUPPLY_CHAIN_CUSTOMER.PDF
  • Enduring Security Framework. (2022b). Securing the Software Supply Chain - Recommended Practices Guide for Developers. https://media.defense.gov/2022/Sep/01/2003068942/-1/-1/0/ESF_SECURING_THE_SOFTWARE_SUPPLY_CHAIN_DEVELOPERS.PDF
  • Enduring Security Framework. (2022c). Securing the Software Supply Chain - Recommended Practices Guide for Suppliers. https://media.defense.gov/2022/Oct/31/2003105368/-1/-1/0/SECURING_THE_SOFTWARE_SUPPLY_CHAIN_SUPPLIERS.PDF
  • Github. (2023). Dependabot · Automated dependency updates built into GitHub. https://github.com/dependabot
  • Ladisa, P., Plate, H., Martinez, M., & Barais, O. (2022). Taxonomy of Attacks on Open-Source Software Supply Chains. https://sap.github.io/risk-explorer-for-software-supply-chains/
  • Ladisa, P., Ponta, S. E., Sabetta, A., Martinez, M., & Barais, O. (2023). Journey to the Center of Software Supply Chain Attacks. https://doi.org/10.1109/XXX.0000.0000000
  • Lella, I., Theocharidou, M., Tsekmezoglou, E., Malatras, A., Garcia, S., & Valeros, V. (2021). ENISA THREAT LANDSCAPE FOR SUPPLY CHAIN...
  • Melara, M. S., & Bowman, M. (2022). What is Software Supply Chain Security? https://arxiv.org/pdf/2209.04006.pdf
  • Ohm, M., Plate, H., Sykosch, A., & Meier, M. (2020). Backstabber’s Knife Collection: A Review of Open Source Software Supply Chain Attacks....
  • Open Source Security Foundation (OpenSSF). (2023). SLSA • Supply-chain Levels for Software Artifacts. SLSA.dev. https://slsa.dev/
  • OpenSSF. (2023). OpenSSF Scorecard. https://securityscorecards.dev/
  • OWASP. (2022). OWASP Top 10 CI/CD Security Risks. https://github.com/OWASP/www-project-top-10-ci-cd-security-risks/blob/main/index.md
  • OWASP. (2023). Dependency-Track | Software Bill of Materials (SBOM) Analysis. https://dependencytrack.org/
  • Peisert, S., Schneier, B., Okhravi, H., Massacci, F., Benzel, T., Landwehr, C., Mannan, M., Mirkovic, J., Prakash, A., & Michael, J. B....
  • Pipikaite, A., Bueermann, G., Joshi, A., Jurgens, J., Bissell, K., Aguirre, C., Browder, T., & Pruitt, J. (2022). Global Cybersecurity...
  • SAP SE. (2023). Risk Explorer for Software Supply Chains. https://sap.github.io/risk-explorer-for-software-supply-chains/#/attacktree
  • Software Freedom Conservancy. (2023). Reproducible Builds. https://reproducible-builds.org/
  • Souppaya, M., Scarfone, K., & Dodson, D. (2022). Secure Software Development Framework (SSDF) version 1.1. https://doi.org/10.6028/NIST.SP.800-218
  • Testifysec. (2023). Witness - pluggable framework for software supply chain risk management. https://github.com/testifysec/witness
  • The Linux Foundation. (2023a). in-toto | A framework to secure the integrity of software supply chains. https://in-toto.io/
  • The Linux Foundation. (2023b). Sigstore. https://www.sigstore.dev/
  • Tidelift. (2023). TACOS Framework. https://github.com/tacosframework
  • Wetter, J., & Ringland, N. (2021). Understanding the Impact of Apache Log4j Vulnerability. Google Online Security Blog. https://security.googleblog.com/2021/12/understanding-impact-of-apache-log4j.html