5 Steps to Improve Your Software Supply Chain Security

Create a software bill of materials for one application: Visibility into one application can help you understand your current component usage. A number of free and paid services are available to help you create a software bill of materials within a few minutes. The bill of materials will help you identify the unique component parts used within your application and the suppliers who contributed them. These reports list all components used, and several services also identify component age, popularity, version numbers, licenses, and known vulnerabilities.

Take inventory within one of your local warehouses: Repository managers (aka artifact repositories) are commonly used by software development teams. Components residing in repository managers can easily be reused across software development. If outdated or defective components reside in the repository manager, they can easily make their way into multiple applications. Start by identifying a repository manager in use within your organization and creating an inventory of the parts cached there. Some repository managers automate this inventory reporting process for you, listing components, versions, licenses, and security vulnerabilities.

Design approval processes to be frictionless, scalable, and automated: Manual reviews of components and suppliers cannot keep pace with the current volume and velocity of consumption. Your organization must not only define your policies for supplier and part selection but also find practical ways to enforce them without slowing down development or inadvertently encouraging workarounds. Policies must be agile enough to keep pace with modern development. Strive to automate policy enforcement and minimize drag on developers.

Enable developer decision support: Developers are the primary consumers of components in software supply chains. Over 80% of an application today is composed of these components with the remainder being custom code. Help developers by automating the availability of security and quality data very, very early in the development lifecycle. By selecting the highest-quality software components early on and verifying the security hygiene of custom code, developer productivity can be improved by 30% as a result of eliminating unplanned, unscheduled work.

Ensure visibility and traceability throughout the software lifecycle: Components can enter the software development lifecycle at many different places. Requests are initiated by developers and the tools they use regularly to build, integrate, and release applications. Since component selection is not a point-in-time event, continuous monitoring should be used to alert you when new and unchecked components have entered the supply chain. Alerts can also tell you when components used are out-of-date or when new vulnerabilities have been discovered. Continuous monitoring will also allow for component traceability, improving overall mean time to repair defects.