Home Source code Report: 64% of Enterprises Have Been Hit by Supply Chain Attacks, Mainly Due to Increased Reliance on OSS

Report: 64% of Enterprises Have Been Hit by Supply Chain Attacks, Mainly Due to Increased Reliance on OSS


The software industry’s reliance on open source along with a sharp rise in dependencies on open source software (OSS) has helped make supply chains a major security target. 64% of organizations have been affected by a software supply chain attack in the last year, according to a report.

The report, The 2022 State of the Software Supply Chain, was produced by an IoT software and solutions provider will return with data from over 100 Revenera audit services projects.

Although raising awareness about the use of open source is the first step to building and maintaining a successful open source management strategy, nearly 70% of organizations lack enterprise-wide policies. company to properly use open source.

Revenera’s audit team identified 12% more issues in 2021 than the previous year, with 2,200 issues discovered per audit project, compared to 1,959 in 2020. 61% of code base files scanned were attributed to open source, up 6 percentage points from 2020.

Additionally, compared to 2020, Revenera saw a 7% increase in binaries, which are more complex than source code in that they often combined IP addresses from multiple sources and are made up of many constituent files. .

In total, software supply chain attacks increased by more than 300% in 2021 compared to 2020, according to a study by Argon Security, recently acquired by Aqua Security. Revenera’s audit team discovered 282 security vulnerabilities per audit project, an increase of 217% from 2020. 27% of these vulnerabilities have a CVSS severity rating of “high”. Despite this, the level of security throughout the software development lifecycle remains low.

However, some companies are trying to mitigate security risks through new regulations and software bill of materials (SBOM).

Industry and markets continue to respond to software supply chain and security risks by increasing regulations aimed at discovering and tracking open source issues through organizations and regulations such as NIST , PCI, OpenChain, OWASP, MITER, NHTSA and GDPR.

An executive order in May began prioritizing SBOM by stating that any software vendor that sells software to the federal government must provide an SBOM.

“As industries and governing bodies increase governance requirements and more companies require SBOM from software vendors as part of the contracting process to prove software supply chain security, have of a complete and accurate inventory of what is in the code will most likely become the norm rather than the exception,” the report states.

Revenera suggested these are the six steps to better secure the software supply chain:

  1. “Understand the construction of the software pipeline and how sources, components and software packages enter.
  2. Produce an accurate SBOM that includes all subcomponents, hidden dependencies, and associated licenses.
  3. Move vulnerability management and license compliance to the left to minimize and mitigate open source risks early in the devops lifecycle.
  4. Collaborate with the main stakeholders of the organization
  5. Empower software developers by providing ongoing training on managing security vulnerabilities and licensing compliance.
  6. Implement an SCA solution that identifies both security and license compliance issues in code.