{"id":87591,"date":"2023-10-25T07:00:00","date_gmt":"2023-10-25T11:00:00","guid":{"rendered":"https:\/\/staging.checkmarx.com\/?p=87591"},"modified":"2025-11-13T20:32:32","modified_gmt":"2025-11-13T18:32:32","slug":"our-vision-securing-the-entire-software-supply-chain","status":"publish","type":"post","link":"https:\/\/checkmarx.com\/blog\/our-vision-securing-the-entire-software-supply-chain\/","title":{"rendered":"Our vision: Securing the entire software supply chain"},"content":{"rendered":"

The use of open source software has quickly exposed all parts of the software development process as part of the overall attack surface, and has even lead to the creation of  new attack types.  <\/p>\n\n\n\n

Organizations must take steps at every stage of the software supply chain to ensure developers\u2019 environments. Enterprises must also make sure processes and secured, so you aren\u2019t leaving your business vulnerable to next-generation SCS attacks, like AI package hallucinations, dependency confusion, typosquatting, and repojacking. <\/p>\n\n\n\n

Let\u2019s dive into a brief history of how \u201csupply chain security\u201d has evolved to the point we are today, what organizations must consider when securing their software supply chain, and how Checkmarx is proactively building new solutions to address this complex and ongoing issue. <\/p>\n\n\n\n

Our mission to secure the entire software supply chain<\/strong><\/h2>\n\n\n\n

For the past 10 years, security professionals have been trained that before you release code, all high vulnerabilities need to be identified and fixed. But over the last few years especially, the world has changed. According to GitHub, open source is now the foundation of more than 90%<\/a> of the world\u2019s software.  Organizations are now facing a shifting attack landscape, along with an overwhelming number of vulnerabilities. The attack landscape is moving from the application itself, to where there are new vulnerabilities and weaknesses \u2013 in the process surrounding your development, and the components you use to build your application. <\/p>\n\n\n\n

What software supply chain security really means<\/strong><\/h2>\n\n\n\n

Traditionally, supply chain security was to a way to gain visibility and mitigate 3rd-party code vulnerabilities through SCA. But as time went on and as new attack types emerged. In a 2021 executive order, software bill of materials<\/a>, or SBOMs, are required for all software sold to the US federal government. The mandate underscores the importance of an accurate list of all open-source software ingredients found in a software-based product.<\/em> The market quickly realized that the scope of software supply chain attacks, and how we prevent these attacks, go way beyond SBOMs and malicious packages.  <\/em><\/p>\n\n\n\n

Supply chain security is defined as a specific aspect of application security that focuses on protecting the software development process and the components used in that process. <\/em>Software supply chain security is not a single solution; it is a discipline. <\/p>\n\n\n\n

Supporting the SLSA Framework<\/strong><\/h2>\n\n\n\n

The Supply-chain Levels for Software Artifacts (SLSA) framework<\/a>, developed in collaboration with the OpenSSF and Google, addresses the growing concern of software supply chain security, offering a structured approach to assessing and improving the integrity of software components used in development. <\/p>\n\n\n\n

<\/p>\n\n\n

\n
\"\"<\/figure>\n<\/div>\n\n\n

SLSA introduces key concepts like artifacts, provenance, digests, immutable references, and build integrity, that provide a systematic way for the software industry to secure the development lifecycle and promote consistent security standards.<\/p>\n\n\n\n

Understanding that the full scope of SCS is beyond a single tool, Checkmarx has implemented a broader strategy to cover things outside of your typical application security posture management, in full alignment with the SLSA framework. <\/p>\n\n\n\n

How Checkmarx is helping you secure your software supply chain<\/strong><\/h2>\n\n\n\n

Today, Checkmarx is providing expert guidance and proven solutions to manage open-source risk, along with new and exciting solutions to start protecting your entire supply chain today. <\/p>\n\n\n\n

In the last few years, one of the biggest emerging threats<\/a> have been malicious packages \u2013 notably different from vulnerable packages. In the SLSA framework, malicious packages are a form of dependency attack where attackers inject or contribute malicious code into open source projects that your developers download and build into your applications. Once downloaded, the attacker’s malicious code is running within your applications, with whatever unknown intent the package carries. <\/p>\n\n\n\n

Checkmarx SCA, introduced in 2021,  was a major step in helping organizations identify and start reporting on their open-source vulnerabilities. We were the first vendor to include malicious package detection inside our SCA solution. Since then, our research team has inspected over 7.6 million open-source packages for all kinds of threats, finding 200,000+ malicious packages. <\/strong>We make that threat intelligence available to you, either in our SCA product, where findings are in the portal or directly in developers\u2019 IDE, or through an API-based threat intelligence feed. <\/p>\n\n\n\n

Checkmarx SCA enables automated SBOM generation, and Checkmarx Container Security, which works with Checkmarx SCA, identifies vulnerabilities in open-source packages included in container images. Together with our partners at Sysdig, we recently announced<\/a> runtime insights, so organizations can get the full picture of pre-production and deployment, gaining visibility into which container images are in-use and prioritize the ones that pose the most risk.<\/p>\n\n\n\n

We realized customers need support in prioritization, especially with all these newly discovered vulnerabilities, so we released Exploitable Path<\/a>. It\u2019s a unique feature that allows our customers to prioritize vulnerabilities in open-source libraries.  <\/p>\n\n\n\n

When you look at the SLSA framework, we also have always led the way in terms of identifying Infrastructure-as-Code (IaC) misconfigurations. We are the driving force behind the most downloaded open-source tool in this area \u2013 Keep Infrastructure as Code Secure<\/a>, or KICS for short.<\/p>\n\n\n\n

All of these are important tools in managing open-source risk, but we are not stopping there. <\/p>\n\n\n\n

Since GenAI  is becoming a popular resource for developers to generate code, a variety of new SCS attacks have recently emerged, such as: <\/p>\n\n\n\n