An Introduction to Software Supply Chain Management

Some of the biggest challenges to incumbents include:

• Leadership teams resting upon their laurels

• Deeply embedded and convoluted development norms

• Increased cyber attacks on software ecosystems

• Long-standing silos erected by software development, application security, and IT operations teams

All About Open Source Software Supply Chain Magic

Enter open source development practices — a key component of software supply chains and modern software innovation.

From the early days of computing, developers have understood that giving common tasks to a pre-designed system was a way to speed up the engineering process and reduce production costs. This has only multiplied today with community-developed software parts, pre-built libraries, and third-party components. Open source software supply chain management saves companies time and money, improves quality, delivers business agility, and mitigates (some) business risk.

The concept is not new. Long before the advent of open source, Isaac Newton famously said, "I see further by standing on the shoulders of giants and I discover truth by building on previous discoveries." This idea is a primary reason why open source components are so attractive to development teams, though some in the industry were reluctant to adopt it at scale.

The same holds true for the increasing use of containerized applications. Simply stated, free and open access to pre-existing software components and containers eliminates the reinvention of wheels. It also exposes software to a global community of “co-developers” to consider and expand upon.

Today, whatever hesitation existed around open source is merely a shadow. The average application is now made up of 85% open source components.

We discuss the profound growth of open source software further in Part 2 of this series.

What’s important today is how development without open source software components is a rarity. Companies must address the process of developing software using components from external sources and recognize that software happens outside their walls and networks. What people, processes, and tools make up the software you deploy?

What is Open Source Software?

Let’s pause for a moment. We’re talking A LOT about open source, and we’ll continue to do so. We’ll also dig into how to use third-party parts rather than creating everything yourself, a big part of software supply chain management. But it’s not everything.

It’s crucial to also understand the other two “building blocks” of software that we’ll be talking about most that flow into your software supply chain — and what we mean by open source:

1. First-party source code - This is the original logic developers write from scratch to communicate the instructions that make up software.
2. Open source - An umbrella term for collaborative source code development, created for public consumption. There are many divisions within this group, the two most important for our purposes are:
   
   1. Review only - Where the code is visible for audit purposes but not for use or modification.
   2. With requirements - Code that you’re free to use if you meet the obligations. Sometimes these are “permissive” and only require mentioning the author(s), while others are protective and/or “copyleft” and require sharing your changes.
3. InnerSource - Projects managed like open source and may use open source components, but not shared outside of a company or group. InnerSource components may power many internal tools and services. The concept is part of a broader movement to bring wildly successful open source principles to internal development teams.

Enter the Software Supply Chain

For many years now, tools and services that were handled by specialized hardware are moving to either mostly or pure software:

• Servers: Virtual CPUs
• Storage: SANs (Storage Area Networks)
• Switches: Soft switches
• Networks: Software-defined networks (SDNs)
• Communications: Software-defined radios 

If your industry relied on a specific kind of chip or hardware, it’s likely shifted to generic, off-the-shelf components controlled by software. And a crucial piece in understanding that landscape is how it’s made up of component parts. In fact, almost no modern software project starts from the ground up. They are instead built atop existing software.

Our focus is on the way these components are developed, shared, and put into use. It is an ongoing and connected process known as the “software supply chain”.

Addressing Software Supply Chain Risk Management in Government

Following multiple, high-profile breaches caused by issues in component software development, in May 2021, President Biden signed the Cybersecurity Executive Order. This document included detailed requirements around the protection and security of the software supply chain. 

Then in August, the White House Office of Management and Budget released a memo Protecting Critical Software Through Enhanced Security Measures. The document further underlined the danger to “the public sector, the private sector, and, ultimately, the American people’s security and privacy.”

A Deeper Understanding of Supply Chains is Needed

While now saying “software supply chain,” is often met with some basic understanding, the definition varies widely. The term is almost always followed by “attack” or “security.” We agree that software supply chain risk management is fundamental, but it’s only one part of managing the software supply chain.

If we as an industry only focus on security, we’re missing possibilities for innovation, maintainability, integrity, and sustainability. Software supply chain management is complex and difficult, but it’s also about decreasing innovation tax, and technical debt, as well as increasing employee happiness, productivity, and revenue. It’s important for developers and security teams to understand, but just as important for DevOps leads, CISOs, general IT professionals and lawyers, and all the people in between.

A Problem Well-Defined is a Problem Half Solved
(John Dewey, 1938)

The lack of understanding mentioned above is why we set out to create this introductory guide to software supply chain governance. What follows is a look at where this came from, why management is difficult, and what that means for the world beyond software. We also look at some of the tools and policies you should be employing to protect your company/development environment/software project, etc.

Before we move on, we also want to note that this will be a living document. As we’ve already said, software supply chains are complex. We know we’ve only scratched the surface on what makes up the software supply chain. And while we think it’s already the most comprehensive overview, we know we’ve missed a lot. We want it to be a truly definitive guide to software supply chain management — and that’s going to take time to get it right. 

Since it might not be possible to do that alone, we’d love your help. If you see something we missed on the topic of software supply chain management, or you’re interested in contributing content to this endeavor, please reach out to us.