Enhanced Security Measures in Software Supply Chains, Yet Strategies Remain Diverse

In the rapidly evolving digital landscape, the security of software supply chains has become a topic of urgent concern for organisations worldwide. This heightened awareness is largely due to high-profile incidents such as the Log4j vulnerability and the SolarWinds attack.

According to the federal Cyber Safety Review Board, the Log4j vulnerability, referred to as an "endemic vulnerability," will have lasting effects, persisting well into the future. Approximately 28% of organisations have already been impacted by a zero-day exploit, underscoring the urgency of the situation.

A study by Enterprise Strategy Group, commissioned by Synopsys, reveals that 75% of organisations have taken steps to improve their software supply chain security following these incidents. The survey, conducted among 350 decision makers in IT, cybersecurity, and application development, suggests a growing recognition of the need for security to become a priority during the development stage.

However, the security of open source software, heavily relied upon by the developer community, remains a contentious issue. A research project, whose name remains undisclosed, indicates that 40% of organisations don't have a great deal of confidence in open source security. The biggest concern for more than half of survey respondents is the high percentage of application code that is based on open source software.

Despite these concerns, efforts to strengthen software supply chain security are underway. Gartner research suggests that management responses to the growing security risks are still in their early stages, being either absent or fragmented. Investments in software supply chain security include multifactor authentication, application security testing, and improved asset discovery.

Yet, despite these efforts, more than one-third of organisations have been exploited due to a known open source software vulnerability in the last 12 months. This highlights the ongoing debate about the security of software supply chains and the reliance on open source software.

As the industry begins to acknowledge the need for security to become a priority, it is crucial that organisations remain vigilant and proactive in their approach to software supply chain security. By addressing vulnerabilities early in the development process and investing in robust security measures, organisations can significantly reduce their risk of being exploited in the future.

Enhanced Security Measures in Software Supply Chains, Yet Strategies Remain Diverse