About the series
Talk Abstract:
Software organizations largely did not anticipate how the software supply chain would become a deliberate attack vector. The software industry has moved from passive adversaries finding and exploiting vulnerabilities contributed by well-intentioned developers, such as log4j, to a new generation of software supply chain attacks, where attackers also aggressively implant vulnerabilities directly into dependencies (e.g., the protestware of node-ipc). Adversaries also find their way into builds and deployments, such as occurred with SolarWinds, to deploy rogue software. Once implanted, these vulnerabilities become an efficient attack vector for adversaries to gain leverage at scale by exploiting the software supply chain.
Software supply chain attacks have grown over 700% per year over the last three years. Section 4 of the May 2021 US Executive Order on Cybersecurity 14028 is on software supply chain security. Other countries and the European Union are working on similar direction. Organizations have published influential documents prescribing tasks organizations should adopt to reduce software supply chain risk, including NIST Secure Software Development Framework (SSDF) Version 1.1 (800-218), NIST Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations (800-161r1), Supply-chain Levels for Software Artifacts (SLSA) v1.0, OpenSSF Secure Supply Chain Consumption Framework (S2C2F), Cloud Native Computing Foundation – Software Supply Chain Best Practices, and OWASP Software Component Verification Standard (SCVS) Version 1.0. This talk will present the Proactive-Secure Software Supply Chain Risk Management (P-SSCRM) model comprising the union of the 72 tasks in the aforementioned documents in the categories of Governance, Product, Environment, and Deployment. This talk will also present empirical results on the adoption of these tasks by industrial organizations based on interviews with practitioners in seven software development organizations.
Bio:
Laurie Williams is a Distinguished University Professor in the Computer Science Department of the College of Engineering at North Carolina State University (NCSU). Laurie is the director of the National Science Foundation-sponsored Secure Software Supply Chain Center (S3C2), and co-director of the National Security Agency (NSA)-sponsored Science of Security Lablet at NCSU, the NSA-sponsored North Carolina Partnership for Cybersecurity Excellence (NC-PaCE), and the NCSU Secure Computing Institute. Laurie is an IEEE Fellow and an ACM Fellow. Laurie's research focuses on software security, software process, and empirical software engineering.
Zoom information
Register in advance for this webinar:
https://nsf.zoomgov.com/webinar/register/WN_rZs4l0pMR9WXAz5vaUdHkw
Or an H.323/SIP room system:
H.323: 161.199.138.10 (US West) or 161.199.136.10 (US East)
Meeting ID: 160 336 9244
Passcode: 246298
SIP: 1603369244@sip.zoomgov.com
Passcode: 246298
After registering, you will receive a confirmation email containing information about joining the webinar.
