The battle lines of cyber defense have shifted. Is your SDLC pipeline ready?

As a 3PAO that also performs advisory functions to next-generation systems, Fortreum has seen significant misconceptions that clients have with shared service models when they procure external supply chain vendors.  This is especially true for clients that adopt “accelerator” vendors that supply pre-built containers.

When adopting an external supply chain vendor service, it is critical that clients understand the following concepts:

• The client is responsible for the scanning and evaluation of software packages that enter the authorization boundary.  The external supply chain vendors do not normally perform this function.  This means that the client is still responsible for scanning the provided supply packages as well validating the contents of the supply packages prior to allowing them into the staging environments for testing and deployment.
  
  
• Scan requirements include compliance scans ( e.g. STIGs) that are applicable for any applicable technologies contained within the supply package.  Validation requirements involve the evaluation of individual package components and subcomponents to confirm that they are not counterfeits and that they have traceability back to a reputable vendor or development team.  Validation is usually performed through certificate based code signing, hash-validations, and the use of the NIST Supply Chain Software Build of Materials (SBOM) concepts (Software Security in Supply Chains: Software Bill of Materials (SBOM) | NIST).
  
  
• While SBOM has been largely pushed as guidance in 2024 via Executive Order 14028, with the advent of additional NIST SR control family checks, it is quickly accelerating to become a soft requirement.  Fortreum forecasts that it will soon (potentially within the next year) become a hard requirement that will be driven by changes being proposed through the new NIST Secure Software Development Framework (Secure Software Development Framework | CSRC)

Entering 2025, the risk of supply chain-based threats has increased exponentially through the expansion of the shared service model as well as the introduction of more global players into the supplier market.  An example of this can be seen in federal systems and the government directive to evaluate and adopt Artificial Intelligence technology to remain on the forefront of capability.  AI and Machine Learning (ML) based capability be entered federal systems through the supply chain.  This will occur through software packages that contain AI capabilities pulled from other external models or services (e.g. OpenAI, AWS Bedrock, Oracle Generative AI, Nvidia AI capabilities such as Morpheus, and open-source capabilities such as Ollama).  Because of this, the supply chain is the front line defense against modern threats associated with rapid technology adoption.