Note-to-self: CIS Software Supply Chain security guide

CIS (Center for Internet Security) has published an interesting guide on software supply chain security.

Even if you do not build software on your own, it still is useful to to pick the relevant security measures/controls as part of your information security management to protect yourself and your enterprise.

As we all learned from the log4j issue which impacted many generally used platforms, it has become very clear that you need to look beyond the first level of control (your own)…

It’s critical to manage 2nd (your suppliers) and even third level (suppliers of suppliers)

Highlights

In high level overview, the document discusses:

1. Source code
   • Code changes
   • Repository management
   • Contribution access
   • Third party
   • Code risks
2. Build pipelines
   • Build environment
   • Build worker
   • Pipeline instructions
3. Dependencies
   1. Third party packages
   2. Validate packages
4. Artifacts
   • Verification
   • Access to artifacts
   • Package registries
   • Origin traceability
5. Deployment
   • Deployment configuration
   • Deployment environment

Supply chain guide access (need to register on CIS)

https://workbench.cisecurity.org/files/3972 (login needed, but it’s non-commercial, limited data protection risk)

More info:

• Original post by Troels Oerting on LinkedIn: https://www.linkedin.com/feed/update/urn:li:activity:6945661110029045760/
• https://venturebeat-com.cdn.ampproject.org/c/s/venturebeat.com/2022/06/22/software-supply-chain-security/amp/

Extra references

Software impacted by Log4j, see the NCSC Github / Software inventory: https://github.com/NCSC-NL/log4shell/tree/main/software

(if necessary this post will be updated with more interesting material, when applicable)