The Cyber Defense eMagazine November Edition for 2023

the fact that many organizations lack even basic visibility into these activities, or try to rely on more
traditional controls such as standard endpoint products, which don't at all align with the threat model
these types of attacks represent. This means that many more such breaches are likely already underway,
albeit undetected.
So how do attackers use these channels to gain initial access, and how does this really change the threat
model? One of the most active vectors that adversaries are currently leveraging to gain a foothold in
organizations is the Open Source Software (OSS) ecosystem. While this may seem a bit unintuitive at
first blush, let's consider briefly how OSS development and consumption has evolved, and what that
statement really entails.
Open Source Software: Rewards and Risks
OSS has risen to prominence in the last two decades, despite having a relatively rich history well before.
These days, nearly every organization in existence, from governments to regulated industries to
advertising agencies, rely on it for business-critical functions. It has led to many great things, including
massive cost reductions for development and faster time to field. However, it does come with sharp
edges.
While many of the more traditional issues, like problematic licenses and unpatched vulnerabilities, are
relatively well understood, there is also an entire strata of new issues that have risen to the forefront in
the last few years as well - driven by a migration of processes from static to continuous, backed by
systems that were fundamentally designed without security in mind.
What does the open-source ecosystem as an access vector really mean, and how does this relate to
developers? Consider that most modern software projects of any sophistication contain thousands of
third-party, open-source software packages. These packages are published, managed, and maintained
by tens of thousands of volunteer software developers from all over the globe. While some may have
corporate backing from a large enterprise, there is fundamentally no sort of traditional supplier
relationship between those who create the OSS, and those who consume it. Everything is effectively
supplied as-is.
These packages are pulled down and incorporated into business-critical systems in a massive, messy
web. For example, a software developer may install a popular package to solve a common business
problem. That package may depend on two or three other packages, which will also silently get pulled
down and installed. Each of those two or three packages, in turn, will likely depend on more packages,
and so on. From a security practitioner's perspective, that single software developer installing that one,
innocuous, popular package has now effectively integrated a supply chain of software spanning
thousands of possible individual software packages, maintained by tens of thousands of strangers that
have no relationship or vetting process of any sort with your organization, into a business-critical piece
of software. Worse yet, each one of those thousands of software packages gets the ability to execute
code each and every time the software developer or CI/CD runner hits "install" or "update."
Cyber Defense eMagazine – November 2023 Edition 105
Copyright © 2023, Cyber Defense Magazine. All rights reserved worldwide.