“Do I Need a Firewall for My Firewall?” Software Supply Chain Security (From The Archives)

Every build that pulls packages straight from a public registry, and every vendor questionnaire accepted at face value, is a trust decision made with little scrutiny. Host Matt Triner talks with Jessica Sweet, VP, Cyber Risk at Hunter Strategy, and Dan Beller, Director of Cloud Solutions at Hunter Strategy, about where software supply chain risk comes from and which habits reduce it. They also cover the breach stories that get developers and executives to pay attention, attackers’ growing focus on edge devices, and whether moving to the cloud makes the supply chain easier or harder to secure.

In this episode

• Jessica names three common risk areas: malicious code inserted into software, vulnerabilities inherited from open source, and weak governance across the development life cycle. She points to SBOMs, the provenance push that followed Executive Order 14028, and CI/CD pipelines that make each build traceable.
• Dan makes the case for sprint zero, the setup phase at the start of a government project. It’s the cheapest time to add SAST, software composition analysis, and other quality gates. Adding them six months into development disrupts velocity.
• Matt uses the 2016 left-pad incident to argue for local package repositories.
  • Dan says proxy repositories keep builds running when an upstream service is down, and many include vulnerability scanning.
  • Matt adds that they force someone to vet packages before accepting every Dependabot version bump.
• Jessica explains why vendor risk assessments often favor financial stability, business continuity, and compliance over what’s actually in the software. She also explains why collecting vendor self-attestations takes so much time for agencies and small businesses.
• Dan says there’s no magic bullet for third-party code. It takes security-aware developers, defense in depth, and the discipline to keep looking when a random GitHub project with five stars does exactly what you need.
• On breach stories, Jessica walks through Log4j, Colonial Pipeline, the May 2024 Ascension ransomware attack, and two 2024 nation-state intrusions: MITRE through Ivanti zero-days and Cisco’s ArcaneDoor.
  • Dan raises the BIG-IP Next Central Manager vulnerabilities.
  • Matt describes customers asking whether they need a firewall for their firewall.
• On cloud, Jessica and Dan see real tooling gains, plus new gaps.
  • Jessica: cloud providers add security tooling, but shared responsibility models leave gaps when roles aren’t clearly defined.
  • Dan: cloud exposes complexity that used to belong to data center teams. Provider design patterns and compliance packs help small teams reach a safe configuration faster.
  • Jessica closes with machine-readable SBOMs and MFA.

Chapters

• 00:00 Intro
• 00:38 Matt sets up the episode and introduces Jessica Sweet and Dan Beller
• 02:03 Common software supply chain risks: malicious code, open source, and weak governance
• 05:04 Good software hygiene and “eating our vegetables”
• 05:32 Sprint zero: building security gates in at the start of a project
• 07:14 Local package repositories and the left-pad lesson
• 09:29 How vendor management overshadows software security
• 11:40 Due diligence on third-party code and the five-star GitHub project
• 13:07 Breach stories that get attention: Log4j, Colonial Pipeline, Ascension, MITRE, and Cisco
• 16:01 Edge device vulnerabilities and “a firewall for my firewall”
• 19:06 Is cloud helping or complicating the software supply chain?
• 21:23 Dan scorecards cloud complexity and shifting responsibilities for dev teams
• 22:53 Best practices: provider design patterns, compliance tooling, SBOMs, and MFA
• 25:13 Wrap-up
• 25:28 Outro

Mentioned in this episode

• Executive Order 14028 (May 2021 order on improving the nation’s cybersecurity, including software supply chain security)
• Software Bill of Materials (SBOM) (CISA’s resources on inventorying the components inside software)
• GitHub Artifact Attestations (signed build provenance for GitHub Actions; in public beta at the time of recording, generally available since June 2024)
• left-pad (npm’s account of the 2016 unpublishing that broke builds across thousands of projects)
• Dependabot (GitHub’s automated dependency update tool)
• Log4j (CISA guidance on the 2021 Apache Log4j vulnerabilities)
• Colonial Pipeline (CISA’s retrospective on the May 2021 ransomware attack)
• Ascension (health system hit by ransomware in May 2024)
• MITRE (April 2024 disclosure of a nation-state breach of its NERVE research network)
• ArcaneDoor (Cisco Talos report on a state-sponsored campaign that planted two backdoors on Cisco ASA devices)
• F5 BIG-IP Next Central Manager (central management platform for BIG-IP Next; vulnerabilities disclosed May 2024)
• Ivanti and Fortinet (edge and VPN products with widely exploited vulnerabilities)
• Microsoft Defender for Cloud (cloud security posture, compliance, and threat protection)
• More than a Password (CISA’s multifactor authentication campaign)

Guests: Jessica Sweet, VP, Cyber Risk, Hunter Strategy; Dan Beller, Director of Cloud Solutions, Hunter Strategy
Host: Matt Triner, CEO, Hunter Strategy