Sharing Responsibility for Protecting the Software Supply Chain

Cyberattacks against organizations are now often using what might be considered a “bank shot” – planting malicious code in software components before they are used in products. When coders draw upon software libraries, whether open source or proprietary, to build new applications, they unwittingly include the malware. This is a less conspicuous method that threatens the software supply chain and harms organizations’ willingness to use systems’ abilities to patch themselves, just as automatic patching has proved critical to guarding against attacks on legacy systems.

Now the National Security Agency and the Cybersecurity and Infrastructure Security Agency have released new guidance, “Securing the Software Supply Chain: Recommended Practices Guide for Customers,” which outlines the steps that customer agencies should take to evaluate and ensure the security and integrity of the software they acquire. This builds on the May 2021 Executive Order that included a requirement for software providers to provide a software bill of materials (SBOM) to their government customers.

Join us as thought leaders from government and industry discuss the nature of complex software environments, the role of SBOMs in identifying endpoint risks across them, and how agencies can use SBOMs to better manage and mitigate those risks.