DEVOPSdigest

In May 2021, the Biden Administration issued Executive Order (EO) 14028, Improving the Nation's Cybersecurity. The legislation urged any organization working with federal agencies to modernize and prioritize security protocols to safeguard the sensitive data created and stored by the government.

A key theme within the EO was the importance of secure software, and rightfully so. Despite the Biden Administration calling attention to this issue, software supply chain attacks in the US impacted over 2,700 organizations(link is external) in 2023 — growing over 50% year-over-year.

To better facilitate the secure development of software built and bought by federal agencies, the Cybersecurity and Infrastructure Security Agency (CISA) and Office of Management and Budget (OMB) created the Secure Software Development Attestation form. Software producers working with federal agencies had until June 11, 2024 for critical software and until September 11, 2024 for all software to submit the form, signed by the software producer's CEO.

The Secure Software Attestation Form Requirements

The Secure Software Attestation Form requires software producers to use industry standards derived from the National Institute of Standards and Technology (NIST) secure software development framework (SSDF). The form calls for software producers to:

■ Protect and segregate network environments involved in building software.

■ Monitor those who have authorization to access the code.

■ Enforce basic security hygiene practices, including multi-factor authentication (MFA).

■ Maintain trusted source code supply chains by managing risks of the supply chain.

Be able to determine the lineage of the software for any internal code, open-source and third-party software components.

■ Utilize automated tools or similar processes to scan for security vulnerabilities, ensuring that software is up-to-date on current releases.

■ Notify any federal agencies if software violates the terms of the Secure Software Development Attestation form.

Are Organizations Ready to Comply?

While the time to fill out the Secure Software Attestation Form has come and gone for critical software and around the corner for all software, a recent survey from Lineaje, conducted a month before the June deadline, revealed significant gaps in software producers' preparedness and awareness.

The survey, which polled over 100 security professionals attending RSA Conference 2024, found that less than one in five companies impacted by the form were prepared to meet the imminent deadline.

Failure to comply with the form requirements has the potential to cause severe consequences for software producers and federal agencies alike, including potential legal and financial penalties for software producers, increased vulnerability to cyberattacks, and damage to both the software producers and federal agencies' reputations.

Despite the looming threats, an overwhelming majority of respondents (84%) had not yet implemented Software Bills of Materials (SBOMs) into development processes — which EO 14028 made mandatory back in May of 2021. Even more concerning, over half (65%) had never even heard of EO 14028. Even those who were familiar with it, half were unaware of its specific requirements.

Organizations Are Missing the Tools and Resources to Secure Software Supply Chain

In addition to the lack of knowledge of the latest compliance regulations, many security professionals simply do not have the tools to identify and mitigate security concerns in the software supply chain.

Open-source software components make up anywhere from 80%-90% of all software built today. While convenient, 82% of open-source software components are inherently risky. Over half of respondents in the survey said their companies utilized open source software components, but only 16% say the average open source is secure.

Many security professionals (56%) claimed to have the tools to identify and mitigate security concerns in open source software, but nearly a quarter were unsure, and one in five had no tools. In addition, 45% of security professionals are struggling with budget limitations and staffing resources (33%) to adopt proper software supply security measures.

Moving Forward

Businesses can't operate without open source software. However, organizations also can't survive long-term if that software is compromised with security vulnerabilities. To stay secure, software vendors and cybersecurity professionals must educate themselves and examine where they fall short on compliance deadlines. Doing so will protect their organizations, and also contribute to enhancing national security. 

In addition, organizations need to prioritize the creation and upkeep of SBOMs. With an SBOM, organizations are able to assess software components' risks and address any vulnerabilities before an adversary can exploit it.

Software producers and consumers must also have real-time visibility into the quality of software components. It can often be the difference between a well-maintained and secure software supply chain, or one that is easily manipulated by threat actors.

Over the next few years, I suspect that compliance measures like EO 14028 will continue to emerge. If the response, or lack thereof, to the Secure Software Development Attestation form is a preview of what we can expect with future legislation, we'll likely see software supply chain attacks continue to plague public and private sector organizations alike. However, if developers and security professionals partner together to create and maintain secure code, prioritize real-time visibility, and commit to investing in technologies that enable them to adequately protect their software supply chain, we may be able to fulfill the vision of improving the nation's cybersecurity after all.