Software supply chain management: can it become a new line of defence against cyber-crime?
In the past two decades or so, software development has evolved. In the past we built applications in a monolithic architecture hosted on a physical server that followed linear processes. Today, that’s more likely to involve the integration of a patchwork of open-source, third-party and proprietary tools and software from a wide array of suppliers. As Emily Freeman, head of devops product marketing at AWS pioneering new approaches to software development, puts it: “software development is a study in entropy, and it is not getting any more simple.”
On the upside, thanks to readily available free and off-the-shelf software components, the time required to build and release new software has decreased from a few years to a couple of months. On the downside, the lack of oversight over the proliferating interdependencies of source code has led to cyber-attacks that have shaken the global business world and spurred political leaders into action – while also flagging up the importance of software supply chain management to achieve all-important visibility.
Software supply chains face a similar problem to their physical counterparts. While manufacturers often have no visibility beyond their tier-one suppliers, software companies have difficulties gaining a full view of the provenance of all the code that goes into their digital infrastructure and products. The growing popularity of cloud services, the ubiquity of applications and APIs – intermediaries that let apps talk with each other – the rise of data storage and analytics as a service and, last but not least, the wealth of available open-source code have all significantly contributed to the current complexity of software supply chains.
Managing open-source software
Although the configuration flaws of off-the-shelf and customised commercial software often leave backdoors to enterprise networks, open-source code – estimated to make up 84 per cent of enterprise software code bases – poses an even bigger challenge. Convinced that potential bugs and flaws in open-source software get detected and rectified by developers of online communities, businesses typically integrate these codes into their systems without reviewing them. As GitHub, the leading platform with 73 million developer members, which is owned by Microsoft, explained in last year’s State of the Octoverse Report, the role open-source code plays can’t be overstated: “You would be hard-pressed to find a scenario where your data does not pass through at least one open-source component. Many of the services and technology we all rely on, from banking to healthcare, also rely on open-source software. The artifacts of open-source code serve as critical infrastructure for much of the global economy, making its security mission-critical to the world.”
Information security experts have already pointed out that trust in open-source software is somewhat misplaced. Although it rarely gets injected with malicious code, human error may leave flaws in it that can offer gateways to core corporate systems. Therefore, subjecting them to the level of scrutiny third-party software is normally exposed to is a great way to diminish the likelihood of sensitive data getting compromised. This is especially crucial given that only a meagre 17 per cent of organisations become aware of new open-source vulnerabilities within a day of public disclosures, which malicious actors don’t hesitate to act upon.
Tools enabling software supply chain visibility
The number of interdependencies between components of enterprise software defies a human’s ability to monitor them. Top open-source projects on Github, for example, can have thousands of contributors, and are at the same time dependencies for millions of repositories relying on them. BOMs (bill of materials) has been originally used in supply chains as an inventory of the raw materials, parts and components needed to manufacture a physical product. The Software Bill of Materials (SBOM), its digital counterpart – which vendors selling to US federal agencies are already required to provide as per President Biden’s Executive Order in May – has to include a comprehensive list of all the commercial and open-source software that a product comprises.
But having a 360-degree view of software components will not suffice. It’s equally important to understand how these components depend on each other to ensure that they all get the latest updates and patches critical to their security. Github’s Dependabot for example, which is designed to instantly patch vulnerabilities after their disclosure, is an ideal tool for making software more resilient.
Software that can enhance application security is also to play a key role in fending off cyber-threats in the future as, according to estimates, about 90 per cent of apps aren't tested for vulnerabilities during their development and quality assurance stages. Thankfully, there is also a wide range of application security testing tools, or ASTs (SASTs for static and DASTs for dynamic), while runtime application security protection (RASP), recognised by US non-regulatory agency NIST as a control to mitigate risk due to “insecure code and software supply chain vulnerabilities”, can detect and block computer attacks.
So, there are plenty of tools, many of them available at no extra cost – which means the ball is now in the regulators’ court: draft legislation that gives organisations the nudge to more widely implement these tried-and-tested controls is now needed.
DCMS’s recent initiative to boost the cyber-security of the UK's digital supply chains by considering mandating IT service providers to follow the National Cyber Security Centre’s Cyber Assessment Framework may be the first step in the UK in that direction. Watch this space.
Zita Goldman
Zita Goldman covers digital transformation with a focus on demystifying digital technologies and showing how they fit into a broader sectoral, macroeconomic, legislative and societal context. She has a passion for connecting the dots of current business and financial news and explaining inconsistencies, for giving hype a reality check and looking behind buzzwords for fresh meaning.
How to make fragile global supply chains stronger and more sustainable
In 2019, global supply chains moved more than US$19 trillion in exported goods. The production and sale of many items we need and use — including toys, clothes, food, electronics and home furniture — depend on global supply chains.
For most of us, supply chains are no longer an abstract concept. The COVID-19 pandemic raised our awareness about the interdependence of our economic systems. We now understand the many ways these chains directly shape and impact our lives.
The pandemic has also revealed the fragility of global supply chains as U.S. President Joe Biden and others warn of the impact on the world economy of continuing supply-chain bottlenecks.
A supply chain is a set of organizations — like suppliers, manufacturers, distributors and retailers — that work together to provide end customers with a specific product or service.
The supply chain becomes global when the product or service crosses multiple international boundaries. Global supply chain organizations are directly and indirectly dependent on each other.
Supply chain problems cascade
Global supply chains have conventionally been focused on achieving financial efficiency above all else. The result is messy and fragile global supply chain systems.
In practice, the decisions made and actions taken by each organization affect the performance of the entire supply chain. A problem at any point feeds other problems at different stages of the chain.
A product shortage at a retail store, for example, might be caused by unsuspected problems such as labour issues, raw material shortages or clogged ports.
Semiconductor shortages are disrupting the automobile industry. Meanwhile, the cost of moving a container from China to the west coast of North America is estimated to have increased by 650 per cent since before the pandemic.
Race to the bottom
The pursuit of financial efficiency has shifted global production to low-cost regions, increased the flows of freights, caused port congestion and eroded the resilience of supply chains. Cutting costs above all else became a race to the bottom. It resulted in global economies with limited redundancies, contingencies and safeguards.
Fragile global supply chains are exacerbated by the fragmentation of decision-making processes, limited collaboration between buyers and suppliers and transactional management. There is no obvious centralized business or authority commanding and controlling these chains. Instead, several companies co-operate and compete for the value created.
Global supply chains also account for large contributions to greenhouse gas emissions and have an impact on air, land and water biodiversity and geological resources. A typical company’s supply chain is responsible for 80 per cent of its greenhouse emissions and more than 90 per cent of its contribution to air pollution generated in the production and distribution of a consumer product.
One billion metric tonnes of emissions could be saved if key suppliers to 125 of the world’s biggest purchasers increased their renewable energy input by 20 per cent.
The impact of supply chains extends to society. For example, the problem of forced labour is well-documented in today’s global supply chains, resulting in several controversies about modern slavery. More than 24.9 million people are documented to be working in slavery conditions in these chains.
Businesses in global supply chains are facing increased pressure from different stakeholders to adopt sustainability and disclose their impacts. A Dutch court recently ordered Shell to reduce its carbon emissions by 45 per cent from its 2019 levels. In the future, supply chain disclosure and transparency will become the norm of good governance.
Robust supply chains in demand
The world needs robust supply chains that are founded on sustainability, collaboration, trust, transparency, visibility and diversification of supply. That new model of supply chains could help combat economic fragility, climate change and inequality.
Global supply chains connect businesses and markets across all layers of economic, social and ecological systems. That means customers, governments and other stakeholders should encourage the emergence of robust and sustainable supply chains.
Responsible decision-making within supply chains has the potential to contribute to economic progress and societal well-being while maintaining the environmental integrity of the planet. Our preliminary research on sustainable blueberry supply chains, to be published soon, indicates that sustainability contributes to resilience.
Supply chain management is a “team sport.” Current research provides ample evidence that collaboration benefits global supply chains. Buyers and suppliers can enjoy higher service levels, more product availability and significant reductions in costs if they work together.
More preliminary research we’ve conducted on personal protective equipment supply chains in British Columbia, also to be published in the weeks to come, shows that collaboration between the supplier and customer reduces costs and risks by at least 17 per cent. Effective collaboration contributes to supply chain resilience and helps avoid future disruptions.
Building effective collaboration means rewarding responsible and long-term management of global supply chains and discouraging short-lived gains. Global supply chains should promote sharing the gains and the pains among buyers and suppliers.
Incentives need to be created to encourage this collaboration. Digitization of the economy will also contribute to better transparency and traceability in global supply chains.
Nonetheless, moving towards robust global supply chains isn’t straightforward because historically, they’ve been focused on short-term rewards. For decades, we’ve justified the development of fragile and fragmented global supply chains in the name of economic growth and financial efficiency. This may have provided short-term benefits, but it has created our current supply chain crisis.
Will that crisis reveal a way forward?
Adel Guitouni, Associate Professor, International Business, University of Victoria; Cynthia Waltho, Postdoctoral Research Fellow, Business, University of Victoria, and Mohammadreza Nematollahi, Postdoctoral Research Fellow, Business, University of Victoria
This article is republished from The Conversation under a Creative Commons license. Read the original article.
Smart labels and allergy sensors – how to make sure the future of food is ethical
Imagine you’re shopping in your local supermarket. You pull out an app on your phone and scan a product. Instantly, it flashes with a personalised risk rating of how likely it is to set off your allergies.
In the next aisle, smart packaging on a ready meal updates you in real time with the carbon footprint of your food’s journey. But once you take it home, the label changes to display a live warning: allergens were detected unexpectedly in the production factory, and your food may have to be recalled.
How much extra energy would be used to power such a system? Who makes sure the app is taking care of your personal medical information? And what if an accidental alert meant you were told to throw away your food when it was perfectly edible, or resulted in a small business being blacklisted by supermarkets?
These are just some of the questions that will require our attention if we manage to connect up the vast amounts of data flowing through the food system by storing and sharing it in systems called data trusts.
As part of a working group on ethics in food data trusts, my colleagues and I have been developing new methods to help food technology organisations ensure systems like these meet ethical standards.
Food production is the largest sub-sector in UK manufacturing, and currently the subject of much scrutiny. In the face of climate change, there is increasing pressure to make supply chains more efficient and cost-effective, as well as to promote sustainability and reduce waste: objectives that new technologies are helping to achieve.
These technologies will allow us to collect data on our food like never before: from sensors which track every moment of a crop’s life cycle; to instant temperature readings on chilled or frozen meat deliveries; to detailed records of what moves on and off supermarket shelves and when.
Sharing this data between different parts of the food supply chain, which may involve many organisations, could bring enormous sustainability benefits: especially if we can then use advanced technologies such as AI prediction and recommendation algorithms to pinpoint customer needs and reduce waste even further.
Many organisations are wary about this data sharing, especially if it might reveal private business information. This is where data trusts come in. The idea is that their trustworthy infrastructure, bolstered by strict policy and legal agreements, will allow companies to be sure that private data will not be seen by, for example, their competitors. But data trusts are likely to also present their own set of unforeseen problems.
Our research
Our working group assessing data trusts, funded by the Internet of Food Things project and the AI3SD project, is made up of experts from many different specialities including computer science, law and design. Before we could start thinking about data ethics, we had to make sure we all understood each other’s language.
Our first task was to create a glossary of terms to tease out the ways in which we use language differently. For example, when we talk about AI, we may be imagining the super-smart intelligence of science fiction, new forms of machine learning that do tasks we cannot, or simply the algorithms that already support many of our day-to-day activities.
Building a common understanding helped us move onto analysing the ethics of data trusts: which do not yet currently exist. By the time they do, it may be too late to correct any major problems they cause.
This is an example of the “Collingridge dilemma”. This philosophical quandary suggests that in the early stages of a new technology, not enough is known about its potentially harmful consequences. By the time these consequences become clear, it may be too expensive – or too late – to control the technology.
One way to get around this is to map out these harmful consequences by imagining, in great detail, what a future which includes these technologies might look like. This is what we do in the research method called “design fiction”, where we create real objects representing a fictional future.
Some of the things we’ve created include minutes from a board meeting that never took place, a clip from a documentary reporting on something that hasn’t happened, a website showcasing a non-existent allergy alert app, and smart packaging that simulates the shopping experience depicted earlier.
In creating these, we tried to consider all the different people who might be positively or negatively affected in the future world to which our objects belonged: including not only decision-makers at large supermarket chains but also smaller suppliers, consumers and workers.
Next steps
The next step was to use these objects to delve even deeper into what challenges they might present. We used a set of cards called the Moral-IT deck, which were developed to evaluate the ethics of technology.
These cards helped lead a discussion with experts about possible harms created by the use of new food systems. For instance, we considered whether smaller food businesses might be unfairly excluded from supermarkets due to not being able to afford the myriad of sensors needed to hook their products up to AI-enabled prediction systems.
Although we focused on the food sector, these methods can be carried over to analyse other areas where new technology is being introduced, such as adding smart bins (that sense when rubbish collection is needed) to public spaces. Our next step is to use what we’ve learnt to create a formal framework guiding people towards informed decisions around how to ethically introduce new technology.
We hope that, through using new, creative methods to analyse and imagine future technologies, we can help people create technological systems that are fairer and more ethical.
Naomi Jacobs, Lecturer in Design Policy, Lancaster University
This article is republished from The Conversation under a Creative Commons license. Read the original article.