A practical guide to software supply chain security

Across industries, organizations rely on IT infrastructure and applications to manage operations, deliver services and products, and gain insight into their business. Security is a critical consideration for these systems and workloads. Data breaches and attacks can result in severe consequences for both businesses and their customers. In fact, the average cost of a data breach in 2023 reached an all-time high of US $4.45 million.

Software supply chain attacks are of particular concern, as they take nearly 9% longer to identify and contain and result in a higher average cost of US $4.63 million. And software supply chain attacks have increased by 742% annually, on average, over the past 3 years.

It’s no surprise, then, that 76% of CEOs say that protecting their partner ecosystem and supply chain is just as important as building their organization’s cyber defenses.

This e-book provides a practical guide for understanding and implementing software supply chain security in containerized and Kubernetes environments. We’ll review the components and architecture of software supply chains, identify areas where vulnerabilities can be exploited, and provide best practices and guidelines for protecting your software supply chain.

The high cost of software supply chain attacks 

Software supply chain security is critical for organizations that depend on applications and digital services to operate.

• Average cost of a software supply chain attack: US $4.63 million
• Average time to identify and contain a software supply chain attack: 294 days
• Share of data breaches originating from software supply chain attacks in 2023: 12%
• Annual increase in software supply chain attacks over the past 3 years: 742%

Understanding software supply chains

Software supply chains are the ecosystems in which software is developed, delivered, and deployed. They include everyone and everything that acts upon or impacts software during its life cycle. All people, components, libraries, tools, processes, and systems that create, build, deploy, and run software are part of the software supply chain.

The 2 main groups of actors in software supply chains are producers and consumers. Producers create and distribute software. Producers include software development companies, open source projects, and development teams in government and public sector organizations. Consumers use software. Consumers can be operations teams within the producer’s organization, external software development organizations, government and public sector entities, and other businesses. In today’s software ecosystem, all producers are also consumers, as anyone who builds software either uses or incorporates third-party tools or components when creating their own products.

While every software supply chain is unique, most follow a similar foundational model. Divided into 4 phases—create, build, deploy, and run—this model shows how sources and dependencies are transformed into artifacts that are integrated into other software or deployed and run as applications.

The following sections discuss the details of each phase in the software supply chain model.