# Transcript: Zero Trust & Securing the Software Supply Chain
This transcript covers two essential topics:
1. **Zero Trust** — how its principles can be applied to secure the software supply chain.
2. **Software supply chain threats** — the types of attacks targeting dependencies and CI/CD pipelines, and mitigation strategies.
---
## Roadmap
1. **Threat Landscape**
Understand key threats and vulnerabilities impacting modern supply chains.
2. **Zero Trust Principles**
Integrate Zero Trust into the developer mindset and workflows.
3. **Dependency Management**
Implement secure selection, auditing, and handling of third-party packages.
4. **Checklist for Action**
Practical checklist for immediate adoption and further research.
---
## Introduction
In cloud-native and DevSecOps environments, threats can surface at **any stage** — from open-source dependencies to pipeline misconfigurations.
Adopting **Zero Trust** ensures “**never trust, always verify**” becomes standard practice.
By the session's end, you should be able to:
- Identify critical supply chain risk points.
- Assess your security posture against Zero Trust.
- Begin mitigations in CI/CD workflows.
---
## Threat Landscape: Software Supply Chain
The **XZ Utils backdoor** and **SolarWinds Orion** cases highlight:
- **Human-led malicious intent**
- **Pipeline compromise**
- **Propagation through trusted updates**
**Key Actions**:
- Use open-source intelligence.
- Enforce strict dependency management.
- Verify build integrity.
---
## Dependency Confusion & Related Attacks
### 1. Dependency Confusion
Attackers publish malicious packages with names matching internal ones.
**Example:** PyTorch incident.
### 2. Typosquatting
Near-identical package names trick users into installing malware.
### 3. Artifact Compromise
Leaked credentials allow malicious artifacts in builds.
---
**Defensive Measures**:
- Automated package name verification.
- Credential hygiene and secret scanning.
- Artifact signing and verification.
- Continuous runtime integrity monitoring.
---
## Lessons from Open Source Security
Open-source software accelerates development but also amplifies **attack surfaces**.
Attacks can penetrate:
- **CI/CD pipelines and build processes**
- **Developer tools via typosquatting**
- **CI runners** with implanted malicious changes
---
### Key Takeaways
1. Apply **Zero Trust** to all tooling, even internal.
2. Use **dependency scanning** and integrity verification.
3. Harden build pipelines.
4. Guard against social engineering attacks.
---
## Zero Trust Principles in the Supply Chain
### Three Core Tenets:
1. **Least Privilege Access**
2. **Verify Everything**
3. **Assume Breach**
---
### Application Examples:
- **Verify Everything**: Strong identity access controls.
- **Protect Artifacts**: Sign, hash, and limit access in CI/CD.
- **Assume Breach**: Treat packages as untrusted; stay proactive.
---
## Zero Trust for Dependency Management
**Before Installation**:
- Verify publisher badges, reviews.
- Look for typosquatting.
- Question large version jumps or sudden activity.
---
**Integrity Verification**:
1. **Checksums** — Compare against known values.
2. **Digital Signatures** — Validate publisher authenticity.
---
### Version Pinning Best Practices
- Lockfiles to fix versions.
- Semantic Versioning for structured upgrades.
- Audit dependencies regularly via:
- Built-in package manager audits.
- Tools like [OWASP Dependency-Check](https://owasp.org/www-project-dependency-check/).
---
### SBOM & VEX
- **SBOM** — Inventory all dependencies, including transitive ones.
- **VEX** — Details on vulnerabilities and exploitability.
**Pipeline Best Practice**:
1. Generate SBOM pre-build.
2. Analyze for CVEs.
3. Block deployment on critical findings.
---
## Builds & Artifact Security
- Sign artifacts with digital signatures and timestamps.
- Store signatures in secure, accessible locations.
- Enforce signing checks in CI/CD gating.
---
### Branch Protection
- Manual code reviews.
- Enforce signed Git commits.
- Continuous audit and monitoring.
- Vendor risk assessments for plugins/extensions.
---
## Secrets Management Best Practices
**Never hardcode secrets.**
- Store as environment variables or mounted volumes.
- Use PKI-signed tokens.
- Employ secret managers (KMS, Azure Key Vault).
- Rotation, revocation, expiration policies documented.
---
## Runtime Security & Immutable Deployment
- Immutable containers prevent runtime tampering.
- Replace containers, don’t patch in-place.
- Regulations (DORA, EU CRA) require component documentation.
- Track versions and dependencies for compliance.
---
## Supply Chain Security Frameworks
- **NIST SSDF**
- **SLSA** (Supply Chain Levels for Software Artifacts)
**Levels**:
1. Baseline visibility
2. Integrity verification
3. Build system hardening
---
## Metrics & Security Gating
**Focus**: Critical/high vulnerabilities — patch within seven days.
**Component-based pipelines**:
- Separate CI/CD for frontends, APIs, etc.
- Component-specific gating.
---
## Developer Checklist
1. **Dependency Management**:
- Pin versions.
- Scan packages.
2. **Artifact Signing**:
- Cosign artifacts.
- Enforce in workflows.
3. **CI/CD Hardening**:
- Access controls.
- Policy as code.
- Security gating.
4. **Monitoring**:
- SBOM integration.
- Metric-driven improvement.
5. **Runtime Protection**:
- Enforce immutable deployments.
---
## Build-Time vs Runtime Dependencies
Assess environment impact:
- If vulnerable dependencies exist in dev-only environments, check for sensitive data.
- Fix all vulnerabilities where feasible, prioritize by criticality.
---
## Q&A Highlights
- **Policy Evolution**: Implement as code, update iteratively.
- **Auditing Third-Party Packages**: Use built-in scans or augment with additional tools.
- **Preventing Code Injection**: Malware scans, entry-point control, runtime monitoring via eBPF.
- **Insider vs External Attacks**: Both possible, enforce strong access control and monitoring.
---
## Final Thought
Securing the software supply chain demands:
- Continuous verification.
- Least privilege.
- Proactive breach assumption.
- Integration of automation for consistent enforcement.
By following these principles, applying strong tooling, and maintaining visibility, teams can significantly reduce the risk of supply chain compromise.
---
