Technology
Software supply chain security for agencies and vendors
The risks in the components software is built from, and the practices that manage them.
Modern software is assembled from open-source libraries, container images, and build tools, each of which can carry vulnerabilities or be compromised. Supply chain security is the practice of knowing what is in your software and managing the risk of each component.
The risks
- Known vulnerabilities in dependencies that are never updated
- Malicious packages published under names similar to popular ones
- Compromised build tools or pipelines inserting code
- Base container images with outdated components
- Vendors whose own supply chains are unmanaged
Practices for developers and vendors
Bill of materials. Generate a software bill of materials for every release listing components and versions.
Dependency scanning. Automated checks against vulnerability databases in the pipeline, with policy on what blocks a release.
Pinned and verified dependencies. Lock versions and verify integrity; do not pull the latest of anything into a production build.
Trusted sources. Approved registries and base images.
Pipeline security. Least-privilege credentials for build systems, signed artifacts, and protected branches.
Update cadence. Regular dependency updates so that patches are small and routine.
Practices for agencies
Procurement. Require vendors to provide a bill of materials, describe their pipeline security, and commit to vulnerability response times.
Inventory. Know what software is deployed and what it contains, so that when a vulnerability is announced the affected systems can be found.
Patching. Apply vendor updates promptly, especially for internet-facing systems.
Standards and guidance
Federal guidance on secure software development and executive actions have made bills of materials and attestations standard in federal procurement. State and local agencies are adopting similar expectations.
Why it matters
Several widely reported incidents have originated in compromised components rather than in the primary software. Knowing what you run is the precondition for responding.