The National Institute of Standards and Technology (NIST) Information Technology Laboratory recently released guidance entitled “Software Supply Chain Security Guidance,” in response to directives set forth in President Biden’s Executive Order 14028—Improving the Nation’s Cybersecurity.
The guidance refers to existing industry standards, tools, and recommended practices that were previously published by NIST in SP800-161 “Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations.” It is designed for federal agencies that “acquire, deploy, use, and manage software from open source projects, third-party suppliers, developers, system integrators, external system service providers, and other information and communications technology (ICT)/operational technology (OT)-related service providers,” but is certainly applicable and helpful to any organization grappling with how to manage third-party software vulnerabilities after the SolarWinds incident.
The guidance walks readers through software cybersecurity for producers and users using the secure software development framework and the process by which NIST gathered evolving standards, tools, and recommended practices to address software supply chain security. The recommended practices include:
- Ensuring that suppliers of software products and services are able to produce a Software Bill of Materials (SBOM)
- Enhanced Vendor Risk Assessments
- Implementing Open Source Software Controls
- Vulnerability Management
NIST publications offer relevant and easy to understand cybersecurity guidance. With the increase we have seen in zero-day vulnerabilities and continued risk of attacks by Russia and China, this is a worthwhile and timely read.