1 Introduction
The term “Software Supply Chain Security (SSCS)” refers to the ability to secure the software development lifecycle (SDLC) process throughout the development, testing, deployment, and maintenance phases – at every point along the way, including along the whole CI/CD pipeline.
Industry awareness of software security has increased significantly since the end of 2020 due to two major attacks on software supply chains. The SolarWinds and the Kaseya attacks affected the systems of many clients and put an increased focus on the need for improving software security.
The SDLC (Software Development Lifecycle) and the entire DevOps cycle, from creating software to running it in the cloud or any other environment, have become much more complex over the past few years. It does not just affect code running as applications, but also building blocks such as Infrastructure as Code (IaC) and the newer trend of Everything as Code (EaC). This complexity is mainly due to the number of tools involved in managing code, such as Source Control Management (SCM) systems, as well as in building applications and deploying and operating code. Unfortunately, this complexity leads to a broadened attack surface.
From the SCM, where both application code and infrastructure-as-code are managed, to cloud-based build and runtime environments, the attack surface includes a multitude of tools that make up the CI/CD pipeline – including code repositories. Moreover, the high degree of integration and automation across the entire pipeline allows for lateral movement of attackers.
Therefore, securing the entire SDLC is both a challenge and an imperative. Code Tampering Prevention is a key element within software security and helps prevent internal or external attacks that tamper with code to create malicious software. Attackers might alter code or inject malicious code at any point, so code tampering prevention must span the entire pipeline.
Successful implementation of a secure SDLC with strong code tampering prevention, therefore, requires solutions that cover all stages of the software delivery pipeline from the SDLC to the runtime environment in an integrated manner.
