{"id":98879,"date":"2024-11-19T18:05:25","date_gmt":"2024-11-19T16:05:25","guid":{"rendered":"https:\/\/staging.checkmarx.com\/?p=98879"},"modified":"2025-12-16T23:42:42","modified_gmt":"2025-12-16T21:42:42","slug":"checkmarx-advances-software-supply-chain-security","status":"publish","type":"post","link":"https:\/\/checkmarx.com\/blog\/checkmarx-advances-software-supply-chain-security\/","title":{"rendered":"Checkmarx Advances Software Supply Chain Security"},"content":{"rendered":"

Software supply chain security (SSCS) attacks are on the rise.<\/p>\n\n\n\n

In fact, according to Infoworld<\/a>, \u201cwe are in the midst of a rapid surge in software supply chain attacks,\u201d with a staggering 742% annual increase, resulting in costs exceeding $4 million. Gartner<\/a> predicted that by 2025, 45% of organizations worldwide will have experienced attacks on their software supply chains, a three-fold increase from 2021.<\/p>\n\n\n\n

The growing number of high-profile SSCS attacks and data breaches (such as SolarWinds<\/a>, NotPetya<\/a>, CCleaner<\/a>, Target<\/a>, Equifax<\/a> and Kaseya VSA<\/a>) have increased awareness of SSCS vulnerabilities. This alarming trend emphasizes the need for enterprises to allocate more resources into securing their software development and deployment processes, from code to cloud.<\/p>\n\n\n\n

But how did we get here? Fifteen years ago, most enterprises exclusively relied on internally developed code. Today, however, most modern code bases are largely built with open source packages and third-party code. While this shift accelerates development and fosters more innovative code, it also introduces more vulnerabilities \u2013 whether from human error, careless exposure of secret keys (passwords, encryption keys, and access tokens), or malicious third-party code. Additionally, the recent uptick in AI-generated code from digital assistants like ChatGPT, GitHub Copilot, and Codestral has further increased the risk of insecure code finding its way into enterprise applications.<\/p>\n\n\n\n

Like it or not, modern development requires the use of third-party codebases, despite the risks they may bring. That\u2019s why enterprises need a solution to effectively manage and mitigate the risks associated with these third-party libraries.<\/p>\n\n\n\n

AppSec Has Traditionally Focused on Internally Developed Code<\/h2>\n\n\n\n
\"\"<\/figure>\n\n\n\n

Figure 1 \u2013 Traditional application security focused only on finding vulnerabilities in proprietary code.<\/em><\/p>\n\n\n\n

Until recently, application security (AppSec) primarily focused on the code developed by the enterprise in-house. This made it easier to detect and remediate security vulnerabilities, because the code was exclusively written by their own developers. Vulnerability detection for these code bases generally relied on static application security testing (SAST<\/a>) and dynamic application security testing (DAST<\/a>).<\/p>\n\n\n\n

In fact, when Checkmarx was founded 18 years ago, we also focused on this traditional AppSec model, concentrating on securing the code developed internally by enterprises.<\/p>\n\n\n\n

Why Software Supply Chain Security Now? <\/h2>\n\n\n\n

What changed? In recent years, the importance of securing the software supply chain from code to cloud has grown steadily among enterprise CISOs, AppSec managers, DevOps teams, and developers.<\/p>\n\n\n\n

This shift is driven by four key factors:<\/p>\n\n\n\n

    \n
  1. Extensive use of open source packages and other third-party code<\/li>\n\n\n\n
  2. Migration of applications to the cloud (cloud-native applications)<\/li>\n\n\n\n
  3. Incorporation of automated compile\/deploy workflows (CI\/CD)<\/li>\n\n\n\n
  4. Proliferation of attacks on the software supply chain<\/li>\n<\/ol>\n\n\n\n

    These changes in modern development have introduced greater risks to software security than ever before. Securing applications now requires involvement from every stage of the software development lifecycle (SDLC), from code to cloud. To address these new threat vectors, Checkmarx developed a comprehensive, integrated solution that protects the entire software supply chain.<\/p>\n\n\n\n

    SSCS Begins With SCA and Malicious Package Protection<\/h2>\n\n\n\n

    Surveys indicate a dramatic increase in the use of open source libraries, with up to 97% of applications now incorporating open-source code. This statistic is not surprising, considering how open-source libraries significantly speed up development and reduce business costs.<\/p>\n\n\n\n

    However, this new, increased use of open source code has also exposed enterprises to a massive new threat vector: both unintentional vulnerabilities and intentionally malicious code \u2013 both of which can be exploited.<\/p>\n\n\n\n

    Checkmarx has adapted to the evolving risks in the software supply chain and has become a leader in addressing these open-source risks. How? Our Software Composition Analysis (SCA) solution provides enterprises with a strong protection against these types of malicious packages. Checkmarx\u2019 SCA solution:<\/p>\n\n\n\n