Software supply chain: review of attacks, risk assessment strategies and security controls

Betul Gokkaya,Leonardo Aniello,Basel Halak

DOI: https://doi.org/10.48550/arXiv.2305.14157

2023-05-23

Cryptography and Security

Abstract:The software product is a source of cyber-attacks that target organizations by using their software supply chain as a distribution vector. As the reliance of software projects on open-source or proprietary modules is increasing drastically, SSC is becoming more and more critical and, therefore, has attracted the interest of cyber attackers. While existing studies primarily focus on software supply chain attacks' prevention and detection methods, there is a need for a broad overview of attacks and comprehensive risk assessment for software supply chain security. This study conducts a systematic literature review to fill this gap. We analyze the most common software supply chain attacks by providing the latest trend of analyzed attacks, and we identify the security risks for open-source and third-party software supply chains. Furthermore, this study introduces unique security controls to mitigate analyzed cyber-attacks and risks by linking them with real-life security incidence and attacks.

What problem does this paper attempt to address?

The paper is primarily dedicated to addressing security issues in the Software Supply Chain (SSC). Specifically, the paper focuses on the following aspects:

1. **Systematic Literature Review**: By analyzing various software supply chain attack cases, identifying common patterns, and utilizing the dataset provided by the Atlantic Council (which includes 161 recorded incidents from 2010 to 2021), the paper determines the latest attack trends.

2. **Risk Assessment Methods**: By integrating multiple risk assessment methods, the paper explores their applicability in software vendor activities. It proposes a comprehensive risk assessment framework to help understand the complexity of managing software supply chain risks.

3. **Security Control Measures**: Based on literature analysis and the proposed risk assessment methods, the paper provides a series of practical security control recommendations. These measures can reduce the likelihood of software supply chain attacks and enhance overall security.

The paper emphasizes the current research gap in the security risk assessment of open-source and third-party software supply chains and attempts to fill this void. By systematically analyzing academic literature, grey literature, and open datasets, the paper aims to provide organizations with a more comprehensive understanding to better assess and mitigate potential software supply chain risks, thereby strengthening the overall security posture.