Introduction
Supply chain attacks have become a significant issue in the tech world. In 2023, over 55% of companies reported experiencing some form of supply chain attack, according to a study by CyberSecurity Ventures. The nature of software maintenance hasn't changed drastically, but the cost model for sharing and distributing software has, making distribution extremely cheap. So, where does the problem lie?
Historical Context
In the 1960s and 1970s, the software development world faced a 'software crisis.' Developers were striving to create reusable software. Demand was exponentially growing, but the ability to produce complex software wasn't keeping pace. Research into modularity and structured programming led to module systems we still use today.
However, starting in the 1990s, the internet changed everything. Software distribution became cheap and accessible. Platforms like CPAN and CTAN allowed for large-scale software distribution, often open-source. Package managers, such as npm and pip, became essential tools, enabling automatic searching, downloading, and building of software.
Current Problems
With this ease of distribution, software is often shared without thorough verification. Each new package added to a project increases the potential attack surface. In 2023, a major attack hit a popular package manager, compromising thousands of projects within hours.
Reusing Less for Better Security
The proposed solution is simple: reuse less software. This doesn't mean returning to the days where every component had to be built by hand, but rather a more rigorous selection of dependencies. Companies need to assess the relevance and security of each dependency before integrating it.
Case Study: Stripe's Approach
Stripe, a payment technology company, has implemented strict policies regarding the use of third-party packages. Each dependency must be approved and regularly audited. This process reduced their potential attack surface by 30% in 2022.
Conclusion
Reusing less software doesn't mean being less efficient. It means being more strategic in the choice of tools and libraries used. By reducing dependence on external components, companies can limit risks related to supply chain attacks.
Let's discuss your project in 15 minutes.