Three U.S. government agencies — Cybersecurity and Information Security Agency (CISA), the National Security Agency (NSA) and the Office of the Director of National Intelligence (ODNI) — have announced the release of the first part of a three-part joint guidance on securing the software supply chain.
The guidance has been created by the Enduring Security Framework (ESF), a cross-sector working group led by the NSA and CISA and focused on addressing the risks threatening critical infrastructure and national security.
The first part of the series, the Securing Software Supply Chain Series – Recommended Practices for Developers [PDF], provides recommended best practices for software developers looking to improve the security of the software supply chain.
“This document will provide guidance in line with industry best practices and principles which software developers are strongly encouraged to reference. These principles include security requirements planning, designing software architecture from a security perspective, adding security features, and maintaining the security of software and the underlying infrastructure,” the group said.
Meant to be applicable to a multitude of scenarios, the guidance offers actionable recommendations for a secure software development lifecycle (Secure SDLC), a first step towards a secure software supply chain.
Development teams are advised to adapt and customize the secure SDLC process to meet their specific needs, identifying the procedures and policies they can use to ensure the implementation of secure development practices.
“The top-level organizational management team must ensure secure development policies and procedures are supported within the budget and schedule and are implemented and adhered to by the assigned development teams,” the guidelines added.
The document details common threat scenarios that may occur during the software development lifecycle and provides recommendations on mitigations, architecture and design documents, the creation of threat models and security test plans, release criteria, vulnerability handling policies, and assessment and training.
The guidelines also recommend various Secure SDLC processes and practices provided by NIST, Carnegie Mellon University, OWASP, US-Cert, OpenSSF, and others.
Related: Software Supply Chain Attacks Tripled in 2021: Study
Related: Cyber Insights 2022: Supply Chain
Related: CISA, NIST Provide New Resource on Software Supply Chain Attacks
More from Ionut Arghire
- OpenAI Patches Account Takeover Vulnerabilities in ChatGPT
- New Wi-Fi Attack Allows Traffic Interception, Security Bypass
- Casino Giant Crown Resorts Investigating Ransomware Group’s Data Theft Claims
- Over 200 Organizations Targeted in Chinese Cyberespionage Campaign
- Nigerian BEC Scammer Sentenced to Prison in US
- China’s Nuclear Energy Sector Targeted in Cyberespionage Campaign
- 14 Million Records Stolen in Data Breach at Latitude Financial Services
- iOS Security Update Patches Exploited Vulnerability in Older iPhones
Latest News
- Musk, Scientists Call for Halt to AI Race Sparked by ChatGPT
- Malware Hunters Spot Supply Chain Attack Hitting 3CX Desktop App
- LeapXpert Banks $22M Funding to Secure Corporate Messaging With Consumer Apps
- Blockchain Security Firm True I/O Raises $9 Million
- Spera Banks $10 Million to Tackle Identity and Access Sprawl
- OpenAI Patches Account Takeover Vulnerabilities in ChatGPT
- OpenSSL 1.1.1 Nears End of Life: Security Updates Only Until September 2023
- New Wi-Fi Attack Allows Traffic Interception, Security Bypass
