By Ashwin Ramaswami
The holiday season is upon us, and while many of us are gearing up for festivities, gift shopping, and reconnecting with loved ones, it’s also a time when cybersecurity threats loom larger than ever. Supply-chain attacks such as SolarWinds and Log4Shell happened during the holiday season, as that is a time of not only especially high usage of technology, but also a time when people are more focused on rest and travel.
As reliance on technology increases, especially open source software (OSS) in applications and infrastructure, the need for robust supply chain security becomes critical. This year, let’s spotlight best practices and resources you can use from the Open Source Security Foundation (OpenSSF) to help ensure that your digital holiday season is both safe and secure.
1. Share Security Best Practices with Friends and Family
When you’re with friends and family during the holidays, it’s an excellent time to share advice on how everyone, regardless of their technical backgrounds, can protect themselves online:
- Use Automatic Updates: Automatic updates are extremely helpful! Ensure your friends and family update automatic updates on all their devices and applications, as these often contain critical security fixes that protect against known vulnerabilities. It’s one of the best ways to continue to stay safe.
- Use Two-Factor Authentication: Encourage enabling two-factor authentication (2FA) on their important accounts, especially financial services. This extra extra security layer can prevent unauthorized access even if passwords are compromised.
- Use a Password Manager: Use a password manager to create and store strong, unique passwords for each account. This prevents the common but dangerous practice of reusing passwords across different services, which can magnify the impact of a data breach from a single service.
2. Prioritize Secure Software Dependencies
Ensuring that your open source software dependencies are secure and up to date is a fundamental practice to safeguard your projects from vulnerabilities:
- Use Dependency Scanning Tools: Leverage OpenSSF Scorecard to identify vulnerabilities, evaluate risks, and assess the health of your open source dependencies.
- Verify Integrity: Use software tools such as Sigstore, SBOMit, and SLSA to verify the authenticity and integrity of open source components before integrating them into your projects. This prevents tampered or malicious code from entering your systems.
- Rely on Maintained Projects: Opt for libraries and frameworks that are actively maintained, have clear security practices, and undergo regular updates. You can evaluate projects’ adherence to best practices using the OpenSSF Best Practices Badge Program.
- Support Critical Projects: Contribute funding, code, or other resources to critical open source projects, especially those identified as essential by the OpenSSF’s Criticality Score Project.
3. Watch Out for Phishing Scams Targeting Developers
Hackers often exploit developers by disguising malicious code as legitimate updates or libraries, especially during the busy holiday season when scrutiny might be reduced:
- Validate Package Sources: Always download packages from trusted and verified package registries. Where available, use registries that support enhanced security features like Trusted Publishers.
- Be Skeptical of Unexpected Updates: If a dependency suddenly releases an unexpected update, take time to review the release notes, recent commits, and changes to contributor lists. This helps identify suspicious activity.
- Secure Your Developer Accounts: Protect your accounts on source control platforms by enabling two-factor authentication (2FA) and using unique, strong passwords. This minimizes the risk of account compromise. For more info on enabling 2FA on source code management platforms, see https://best.openssf.org/SCM-BestPractices/.
4. Monitor Your Software Supply Chain
Maintaining visibility into your software supply chain is essential to identifying and mitigating risks effectively:
- Adopt SBOMs: Generate and maintain Software Bills of Materials (SBOMs) for all your projects. These comprehensive lists document all components and dependencies, along with their versions, to streamline audits and risk management.
- Use Tools like GUAC: Tools such as GUAC (Graph for Understanding Artifact Composition) provide deep insights into your software dependencies, highlighting vulnerabilities and potential risks in your supply chain.
- Patch Quickly: Regularly monitor for and apply security patches to open source software dependencies as soon as updates are released. Delaying patches increases your exposure to known vulnerabilities.
- Use Automated Updates: Leverage automated dependency management tools that notify you of new versions and vulnerabilities, allowing you to stay informed and keep your software up to date without manual effort.
5. Raise Awareness Within Your Organization
Cybersecurity is a shared responsibility, and an informed team is your first line of defense against threats:
- Educate Your Team: Provide training programs on identifying and mitigating supply chain risks, including common OSS vulnerabilities. OpenSSF’s Secure Software Development Fundamentals courses are excellent resources to enhance your team’s skills.
- Engage with OpenSSF: Encourage team members to actively participate in OpenSSF working groups and projects. Staying engaged with the community helps your organization stay ahead of emerging threats and best practices.
- Promote Transparency: Share your organization’s approach to OSS security, such as your use of SBOMs or your dependency management policies, with users and contributors. This builds trust and fosters collaboration.
6. Stay Alert for Risks
Cyberattacks during the holidays can result in significant financial and operational consequences, particularly for organizations that rely heavily on OSS. Here’s what you can do to mitigate these risks:
- Audit Your Software Use: Conduct regular reviews of how OSS is used across your organization. Identify gaps in your security policies and address them with clear procedures and tools.
- Backup Critical Systems: Ensure your critical systems and data are backed up securely. Regularly test your backup and recovery processes to confirm they function as expected, especially under emergency conditions.
- Share Security Findings: If you discover a vulnerability in an open source dependency or tool, report it responsibly to the maintainers or via coordinated disclosure platforms. Refer to the OpenSSF’s Coordinated Vulnerability Disclosure (CVD) Guide for Finders to follow best practices.
By following these principles and leveraging the resources of the open source software security community, you can help safeguard not just your peace of mind during the holiday season, but also the broader digital ecosystem. Together, let’s make open source software more secure, one project at a time.
Stay vigilant, stay secure, and enjoy a happy and safe holiday season!