Applying software updates and patches as soon as possible is a cyber security best practice, but what if an update contains malicious code inserted by a hacker? Software supply chain attacks are a serious and growing problem for both private-sector organizations and the federal government. Among other incidents, Chinese nation-state hackers successfully breached numerous third-party contractors working for the U.S. Navy on multiple occasions over an 18-month period.
The Navy contractor attacks and similar incidents were the impetus for the federal government barring agencies from purchasing certain vendors’ software and hardware. However, these bans don’t address the root of the problem, which is that security must be baked into the software development lifecycle (SDLC) from the very beginning. This is why NIST has proposed a Secure Software Development Framework (NIST SSDF).
What’s in the NIST SSDF?
While there are many SDLC frameworks, few specifically address secure software development; they were designed to speed up and bring order to the development process, not ensure security. Instead, project managers are left to integrate secure development practices on their own.
The proposed NIST SSDF does not introduce any new practices. It curates high-level secure software development best practices from a number of existing sources. So that the framework is flexible, it does not specify how to implement its recommendations. Implementation will look different in every organization, as data environments, security objectives, and priorities greatly differ.
The proposed framework includes 19 best practices for secure software development, grouped under four categories.
Prepare the organization. The best practices in this category are about aligning the organization’s people, processes, and technology to build a strong foundation for secure software development. It outlines practices such as ensuring that security requirements for software development are known at all times so they can be taken into account throughout the SDLC; making sure that everyone involved in the SDLC knows what their roles and responsibilities are regarding secure development; and using automation to improve the accuracy, consistency, and comprehensiveness of security practices.
Protect the software. Software must be secured against tampering and unauthorized access, both intentional and accidental. The best practices in this category address how to secure source code for in-house projects and provide recommendations to aid end users in ensuring that the software they acquire is legitimate and has not been tampered with.
Produce well-secured software. The best practices in this category seek to maximize software security and minimize vulnerabilities in each release. Many developers have not been educated in secure development practices and end up unknowingly producing insecure code. In addition to addressing secure software development practices for in-house projects, it provides recommendations for verifying that third-party software meets security requirements.
Respond to vulnerability reports. This step focuses on identifying potential vulnerabilities in each successive release, addressing them, and preventing similar problems in future releases.
NIST hopes that the recommendations in the SSDF benefit both sellers and buyers in the software supply chain. Sellers who adopt secure software development practices will address the root causes of supply chain cyberattacks by minimizing potential vulnerabilities in each release and mitigating the impact of undiscovered vulnerabilities. Buyers can adapt these practices and incorporate them into their software acquisition processes.
The public comment period for the draft NIST SSDF began on June 11 and ends on August 5, 2019.
Michael Peters is the CEO of Lazarus Alliance, Inc., the Proactive Cyber Security™ firm, and Continuum GRC. He has served as an independent information security consultant, executive, researcher, and author. He is an internationally recognized and awarded security expert with years of IT and business leadership experience and many previous executive leadership positions.
He has contributed significantly to curriculum development for graduate degree programs in information security, advanced technology, cyberspace law, and privacy, and to industry standard professional certifications. He has been featured in many publications and broadcast media outlets as the “Go-to Guy” for executive leadership, information security, cyberspace law, and governance.