SoK: A Defense-Oriented Evaluation of Software Supply Chain Security

Eman Abu Ishgair,Marcela S. Melara,Santiago Torres-Arias

2024-05-29

Abstract:The software supply chain comprises a highly complex set of operations, processes, tools, institutions and human factors involved in creating a piece of software. A number of high-profile attacks that exploit a weakness in this complex ecosystem have spurred research in identifying classes of supply chain attacks. Yet, practitioners often lack the necessary information to understand their security posture and implement suitable defenses against these attacks. We argue that the next stage of software supply chain security research and development will benefit greatly from a defense-oriented approach that focuses on holistic bottom-up solutions. To this end, this paper introduces the AStRA model, a framework for representing fundamental software supply chain elements and their causal relationships. Using this model, we identify software supply chain security objectives that are needed to mitigate common attacks and systematize knowledge on recent and well-established security techniques for their ability to meet these objectives. We validate our model against prior attacks and taxonomies. Finally, we identify emergent research gaps and propose opportunities to develop novel software development tools and systems that are secure-by-design.

Cryptography and Security

What problem does this paper attempt to address?

This paper focuses on the security issues of software supply chain, particularly from a defensive perspective to assess and address this problem. In recent years, high-profile attacks on software supply chains have attracted attention to the vulnerabilities of this complex ecosystem. Despite various audit and validation frameworks proposed by previous research, practical operators still face challenges in understanding and implementing defense measures.

The paper proposes a model called AStRA (Artifacts, Steps, Resources, PrincipAls), which is a graph-based conceptual framework for representing the basic elements of software supply chains and their causal relationships. Through this model, the paper identifies the security objectives required to mitigate common attacks in the supply chain and systematizes recent and mature security technologies to evaluate their ability to meet these objectives. The model is validated through verification of past attacks and classifications, highlighting gaps for future research, and suggesting possibilities for developing software development tools and systems with built-in security.

The main contributions of the paper include:
1. AStRA model, a graph-based framework for comprehensive representation of software supply chains.
2. Identification of security objectives for each AStRA element and categorization of defense techniques.
3. In-depth validation of the AStRA model.
4. Discussion of future research directions for software supply chain security.

The study found that despite existing research on attacks, there is a lack of defensive approaches that provide holistic solutions from the underlying level. The AStRA model aims to address this problem by clarifying the dependencies and causal attributes among participants, steps, and resources in the supply chain to better assess risks and design effective defense measures.