Software Product companies have to choose what materials to build their software with. Pypi, NuGet, Node, Crates, so many options abound.
With each decision it is wise to integrate build integrity in the very beginning.
**
What is build integrity?
**
Build integrity is the assurance that the software assembled and delivered to production is the software the team intended to build.
We do it everyday with physical products...When we go shopping for groceries.
Shopping for clothing online or in-person.
Decide on build materials such as paint, wood or pipe for a DIY project.
Oftentimes due to familiarity and success with a product in the past we buy or use these materials without a second thought.
Until....
We are hit with a recall notice online or in the news about an item we purchased!!
For Software Security this is just as important. Malware and vulnerabilities can drastically damage a company overnight.
Insightful Statistics on this issue:
- 454,648 new malicious packages last year found.
- 56% of recorded malicious packages were classified as “repository abuse”
Source: Sonatype SSSC Report
The answers to the following questions should be verified before a product is downloaded:
- Where did this product come from?
- Has the source or repo established a reputation of quality products?
- What reasons do we have to trust the manufacture of this product?
- Can we cryptographically prove our reasons for trust?
OpenSSF Scorecard and manual repository research help answer these questions.
The hackers are really not the biggest threat, it is the quality of the product that we build with that is the greatest threat vector.
How does your team currently verify build integrity?
Top comments (0)