Software Supply Chain
The complete chain of software development, building, testing, and delivery, encompassing third-party components, open-source libraries, build systems, and other stages. It is a significant area of focus in cybersecurity.
Timeline (last 90 days)
Wiz's CTO believes the problem is not the destructive power of a single vulnerability, but that the fragility of the software supply chain is being exploited at scale.
The advertising technology stack is regarded as a new type of attack surface similar to the software supply chain, where an attacker only needs to replace or inject malicious assets at any link in the chain to achieve one-to-many poisoning of a massive number of sites.
The auto-update mechanism changes the trust model of the software supply chain: traditional software trust is built on a specific version, whereas a self-updating component pulls a new version from a remote source in the background and replaces itself in place, without asking for the user's consent again.
A self-updating process actively pulls new code from a remote source and executes it at runtime; if the update path is hijacked or the upstream is poisoned, the local environment will execute untrusted code without human review, making this a high-incidence point of software supply chain risk.
Trust in dependencies reduces the cost of collaboration but accumulates systemic risk, and supply chain security incidents are the price paid for the collective reluctance to know the details
Modern software projects depend on hundreds or even thousands of third-party packages on average, the vast majority of which have not undergone formal security audits
Leaked credentials and software supply chains are and will continue to be the path of least resistance for attacks.
All Facts (7)
Wiz's CTO believes the problem is not the destructive power of a single vulnerability, but that the fragility of the software supply chain is being exploited at scale.
50%UnverifiedThe advertising technology stack is regarded as a new type of attack surface similar to the software supply chain, where an attacker only needs to replace or inject malicious assets at any link in the chain to achieve one-to-many poisoning of a massive number of sites.
50%UnverifiedThe auto-update mechanism changes the trust model of the software supply chain: traditional software trust is built on a specific version, whereas a self-updating component pulls a new version from a remote source in the background and replaces itself in place, without asking for the user's consent again.
50%UnverifiedA self-updating process actively pulls new code from a remote source and executes it at runtime; if the update path is hijacked or the upstream is poisoned, the local environment will execute untrusted code without human review, making this a high-incidence point of software supply chain risk.
50%UnverifiedTrust in dependencies reduces the cost of collaboration but accumulates systemic risk, and supply chain security incidents are the price paid for the collective reluctance to know the details
50%UnverifiedModern software projects depend on hundreds or even thousands of third-party packages on average, the vast majority of which have not undergone formal security audits
50%UnverifiedLeaked credentials and software supply chains are and will continue to be the path of least resistance for attacks.
50%