Context Matters: Why Vetted Component Lists Are Mostly Security Theater

No ratings

Presented at GrrCON Cyber Security Summit and Hacker Conference 2023 by

Cortez Jr.

Securing the software supply chain across a large enterprise is a gargantuan task. To solve this problem, enterprise security teams often create established lists of “allowed” components that their developers can choose to use as direct dependencies. These lists are created by analyzing both the components themselves and their transitive dependencies. The general consensus is that this practice keeps vulnerable components out of developer ecosystems and reduces downstream risk. But contrary to popular belief, these vetted component lists don’t improve the security of the software supply chain in actual practice. In this talk, we’ll explain: -The common mistakes process implementers make that introduce vulnerabilities -How application build tool behavior and dependency install plans are the catalyst for insecure applications -What teams can do to understand build context, harden their process, and avoid introducing new vulnerabilities