A 'Golden Pipeline' To Secure The Supply Chain

Today’s business leaders need to address some key challenges as they forge ahead with digital transformation plans. On the one hand they need to press the fast forward button when it comes to developing software that offers a better or more specialised customer experience, so they can stay on the front foot where market leadership is concerned.

On the other, they need to ensure their software development cycles are robust and secure, because the stakes are high when it comes to supply chain vulnerabilities. 

A growing dependence on the open-source software ecosystem that sits at the heart of modern software development means that software supply chains are increasingly at risk of compromise. Indeed, last year saw a record breaking 742% jump in open source software supply chain attacks perpetrated by cybercriminals looking to exploit malicious code unwittingly introduced into commercial applications. 

To address this threat, organisations need to build immutability and security into their software development pipelines. Templating a ‘golden pipeline’ that will prove reliable time and time again.

Incorporating Security By Default

Under growing pressure to deliver software faster, developers are increasingly reliant on open-source code and other third-party components that enable them to build products and services more rapidly. The problem is this introduces potential vulnerabilities into development pipelines that will likely expose organisations to supply chain attacks.

As a result, building security into the development process has become a top priority for organisations looking to avoid the risk of a supply chain compromise.

This is no easy task when security teams are wrangling multiple tools to try and connect the dots and need to avoid compromising development flows at all costs. We’re seeing that regardless of multiple large investments in development and security tooling, companies still find themselves resorting to manual exports and correlation processes to attempt to extract valuable insights across the different tools. 

To overcome these issues, organisations should incorporate comprehensive and inter-related security testing and validation from the get-go and across their entire end-to-end application development and deployment process. 

The 'Golden Pipeline' Principles – Start Clean, Stay Clean & Store Approvals

By embedding and automating security and enforcement practices across the supply chain, organisations can create a ‘golden pipeline’ that ensures an application is validated at every stage of development. So, by the time it reaches production, it’s as clean as possible – and all known supply chain risks have been eliminated. 

Principle 1 - Start clean:   When it comes to building a golden pipeline, organisations should first aim to start ‘clean’ by integrating auto-triggered periodic scans into their source code management (SCM) system. Designed around a defined policy that triggers specific actions and responses, this will help assure the quality and integrity of existing components, keeping them up to date with a real-time updated vulnerability and risk database. 

Principle 2 - Stay clean:   Next, to ensure their pipelines ‘stay clean’ and are secure-by-default, every new pull request by a developer should activate an automated scan that generates a pass/warn/fail outcome. These results are then notified to developers via the SCM, together with any fix suggestions. 

Principle 3 - Store approvals:   At the build stage a definitive automated scan provides the final audit and seal of approval. If compliant, the component gets the green light and goes into production – accompanied by a detailed software bill of materials (SBOM) and security manifest that provides full visibility into all software components and dependencies. If yes, this is stored in a manageable pane with all other SBOMS, for clear and easy investigation whenever needed. If not, teams gain insights into next actions to take.

By incorporating robust policy-driven controls into the development pipeline, organisations are able to get instant feedback on supply chain risks.

This means vulnerabilities can be caught and fixed the moment they are introduced, and before they reach run time, a stage in the application’s lifecycle where the stakes (and the costs) are much higher.

Counting The Gains

Companies that commit to this golden pipeline reporting approach are able to achieve some significant returns on investment. Alongside protecting revenue streams from the risks arising from application breaches or compliance issues, they’ve benefited in a number of other key ways: 

  • Automating previously manual processes to streamline their programme orchestration and cut the time and cost associated with patching and remediation. 
  • Giving back valuable time and bandwidth to their security and development teams that can be used more productively on other projects. 
  • Consolidating and reducing the number of security tools they need to procure and use – generating further sizeable cost savings that go straight to the bottom line.

In addition to elevating the supply chain defence posture of the enterprise itself, implementing a golden pipeline enables organisations to develop and deploy applications faster. Generating efficiencies along the way that will make a lasting contribution to the long term sus

Nurit Bielorai is Go-To-Market Manager, Supply Chain Security at Aqua Security

You Might Also Read: 

Which CI/CD Tools Can Promote Supply Chain Security?:

___________________________________________________________________________________________

If you like this website and use the comprehensive 6,500-plus service supplier Directory, you can get unrestricted access, including the exclusive in-depth Directors Report series, by signing up for a Premium Subscription.

  • Individual £5 per month or £50 per year. Sign Up
  • Multi-User, Corporate & Library Accounts Available on Request

Cyber Security Intelligence: Captured Organised & Accessible


 

« Cybersecurity Is No Longer The Sole Responsibility Of IT Specialists 
DoppelPaymer Hackers Caught »

CyberSecurity Jobsite
Check Point

Directory of Suppliers

Directory of Cyber Security Suppliers

Directory of Cyber Security Suppliers

Our Supplier Directory lists 8,000+ specialist cyber security service providers in 128 countries worldwide. IS YOUR ORGANISATION LISTED?

IT Governance

IT Governance

IT Governance is a leading global provider of information security solutions. Download our free guide and find out how ISO 27001 can help protect your organisation's information.

MIRACL

MIRACL

MIRACL provides the world’s only single step Multi-Factor Authentication (MFA) which can replace passwords on 100% of mobiles, desktops or even Smart TVs.

Jooble

Jooble

Jooble is a job search aggregator operating in 71 countries worldwide. We simplify the job search process by displaying active job ads from major job boards and career sites across the internet.

LockLizard

LockLizard

Locklizard provides PDF DRM software that protects PDF documents from unauthorized access and misuse. Share and sell documents securely - prevent document leakage, sharing and piracy.

The Networking People (TNP)

The Networking People (TNP)

TNP supplies independent advice allowing large organisations to design, build and operate their own networks independently of the established telecoms companies.

Arcitura Education

Arcitura Education

Arcitura is a leading global provider of progressive, vendor-neutral IT training and certification programs.

Cybercom Group

Cybercom Group

Cybercom offers strategic advice, testing & quality assurance, security solutions, system development, integration, management and operation services.

ENAC

ENAC

ENAC is the national accreditation body for Spain. The directory of members provides details of organisations offering certification services for ISO 27001.

MSPAlliance

MSPAlliance

MSPAlliance is the world’s largest industry association and certification body for cloud computing and managed service professionals.

Vietnamese Security Network (VSEC)

Vietnamese Security Network (VSEC)

Vietnamese Security Network (VSEC) is an information security company providing website vulnerability scanning and monitoring services.

RealCISO

RealCISO

RealCISO is a CISO grade cloud platform to help companies understand, manage, and mitigate their cyber risk.

SecureAge Technology

SecureAge Technology

We’re a rapidly growing cybersecurity company with an 18-year history of ZERO Data breaches. Our security solutions place security and usability on equal footing. Learn more about our technology.

Oivan

Oivan

Oivan harnesses the strengths of the web, mobile, cloud, cybersecurity, and blockchain technologies to help our clients to launch transformative digital services.

Fibernet

Fibernet

Fibernet's innovative solutions in the fields of cybersecurity and fiber optics range from telecommunications infrastructure to small business cybersecurity.

Sendmarc

Sendmarc

Sendmarc automates the process of protecting your domain from being used in email impersonation and phishing attacks.

UM6P Ventures

UM6P Ventures

UM6P Ventures is an African based early-stage ventures firm operating two funds; a Digital Transformation fund and a Deeptech Ventures fund.

ThreatFabric

ThreatFabric

ThreatFabric integrates industry-leading threat intel, behavioral analytics, advanced device fingerprinting and over 10.000 adaptive fraud indicators.

Fulcrum Technology Solutions

Fulcrum Technology Solutions

The Fulcrum team of technologists are recognized experts in the fields of IT Infrastructure Technology, Security, Service Management and Support.

SecureLake

SecureLake

SecureLake (formerly Managni) is one of the most trusted US-based IT security and infrastructure companies.

Nyx Technology

Nyx Technology

Nyx Technology is your dedicated partner in navigating the intricate world of cyber security, providing you with cutting-edge threat intelligence to safeguard your digital assets.