The Unknown Risks of The Software Supply Chain: A Deep-Dive
Jan 24, 2024
Vulnerability / Myrror Security
In a world where more & more organizations are adopting open-source components as foundational blocks in their application's infrastructure, it's difficult to consider traditional SCAs as complete protection mechanisms against open-source threats. Using open-source libraries saves tons of coding and debugging time, and by that - shortens the time to deliver our applications. But, as codebases become increasingly composed of open-source software, it's time to respect the entire attack surface - including attacks on the supply chain itself - when choosing an SCA platform to depend upon. The Impact of One Dependency When a company adds an open-source library, they are probably adding not just the library they intended to, but also many other libraries as well. This is due to the way open-source libraries are built: just like every other application on the planet, they aim for a speed of delivery and development and, as such, rely on code other people built - i.e., ot...
