How does one defend against software supply chain attacks?

Question

In reference to the Solarwinds attack, since many organisations have no access to the source codes of the software vendors from whom they just consume the services, how can organisations defend against supply chain attacks?

Answer 1

You can't avoid the risk, but you can mitigate it in several ways.

• Reducing the attack surface. Instead of using lots of tools from lots of different vendors, only use a few ones that you really need. Uninstall anything that you don't need. Less software running on a machine means a lower risk of infection.

• Separate environments, virtualization, other kinds of separation in general. If you keep some software separated from other important data, you can mitigate the impact of an infection. For example, if you run some software inside a virtual machine, a supply-chain infection of such software won't affect the external environment (unless it is combined with the exploitation of a severe bug in the VM). Using separate physical machines to run different software (maybe less trusted software) is another option. Other kinds of separation in general could be anything related to separation of privileges, or separation of networks, strict firewall rules, etc. Lots of these security controls could be considered to be part of what is often called defense in depth.

• Detection. You might accept the risk of infection, as long as you are able to detect the infection as soon as possible. Intrusion detection systems and periodic audits will alert you if anything suspicious is going on, and you will be able to limit the damage.

• Independent software analysis and review. Open source software can be inspected before compiling and installing it. If you don't have a team of programmers and security professionals though, reviewing all the new code in every new release is going to be impossible, so this kind of defense can only be attempted by large organizations. Note that this process takes time but on the other hand updates usually need to be installed as soon as possible, so you need a good patch management plan to find a balance.

• Write your own critical software. This is usually done when you are too scared of relying on an untrusted party for something that is critical to your business. There might not be open source alternatives to what you need, so you might not want to trust a closed-source binary blob. Or you might be a government agency that can't trust software from another country. Whatever the reason, remember that writing your own application might require an enormous amount of resources, that often you'd better spend on the other points I mentioned (analysis, detection, patch management, security controls in general, etc.).

Answer 2

This kind of attacks are why ISO 27002 has chapters 14 and 15 (acquisition and supplier relations). In theory, properly checking the security aspects of systems you source elsewhere should secure you as good as possible. In reality, you are limited by the information available and that's rarely the source code. But let's not kid ourselves, even if you had the source code, it would be unlikely that you find any issues in it, unless you're the NSA.

Thus the first answer is that a critical assessment of the security of your suppliers, including any certifications they hold, etc. ensures that you buy something that doesn't fall apart as soon as someone looks at it funny. It's a good practice to do that.

The second answer is that Solarwinds is ISO 27001 certified plus a bunch of other certifications and that didn't do squat because it doesn't include a peer-review of all source code or other deep analysis. I do ISO 27001 stuff for a living and the amount of actual security a certification gives you is fairly basic. It's a great tool in an age where most companies fail to achieve even basic security that anyone with some resources doesn't laugh about, but if you are looking for assurance that a state-level or other high-competence threat actor didn't compromise them, it's worthless.

So the third answer is that for your REALLY important stuff, you trust nobody and nothing and you have as many layers as protection as you can get. Eventually, your data has to be stored somewhere and must be worked on with something, but does that stuff have to have Internet connectivity? Do you need outgoing traffic to the whole world (including the malware C&C servers)? Do you need every software to be able to access every file on your devices? Does data you don't access at this time need to be stored unencrypted?

With a good defense-in-depth, you can reduce the impact of even a successful breach, and supply-chain or not, in the end what happened was simply that customers of Solarwinds got a piece of malware installed. It didn't magically disable their firewalls or DLP systems.

So if your security philosophy is not to build an impenetrable castle but to assume that you're already breached and work towards securing as many crown jewels as possible in that scenario, then such attacks have a limited impact on you.

Answer 3

In practice, they cannot. They would have to build from scratch their internet browsers, their operational systems, their routers, their computers. It's not possible because companies have to rely on others, and even after researching the security practices of all suppliers and choosing those with solid security, some of them can be compromised.

You have little resort if your antivirus company got breached and software running with SYSTEM privileges on every computer and cell phone of the company got compromised. And even if you have a very skilled security team and are following security best practices, those attacks will damage you.