Key Takeaways for Java Developers from the State of the Software Supply Chain Report

@spoole167
@spoole167
Steve Poole
KEY TAKEAWAYS FOR JAVA
DEVELOPERS FROM THE STATE OF
THE SOFTWARE SUPPLY CHAIN
REPORT

@spoole167
Director of Developer Advocacy, Security Champion,
DevOps practitioner (whatever that means)
Long time Java developer, leader and evangelist.
I’ve been working on Java SDKs and JVMs since Java was less
than 1.
JavaOne Rockstar, JSR leader, committer on open source projects
including ones at Apache, Eclipse and OpenJDK.

@spoole167
Not just the Maven Central people

@spoole167
sonatype.com/state-of-
the-software-supply-chain

@spoole167
The Software Supply Chain report is constructed…
● By examining what’s on Maven Central
● By looking at what’s in other public Repos for most
programming languages
● By reviewing what customers hold in their Nexus repos
● By analysing behaviour on public github repos etc
● By working with open source communities and governments
● by calculating what this all means in terms of risk and cost

@spoole167
What’s a Software Supply Chain?

@spoole167 @spoole167
At some point we all find ourselves searching for code …

@spoole167
so we can add a new
dependency

@spoole167
You might think A software supply
chain is about dependencies …

@spoole167
“A software supply chain refers to the process and components involved in the creation, development, and
maintenance of software”
Dependenci
es and
Libraries

@spoole167
“A software supply chain refers to the process and components involved in the creation, development, and
maintenance of software”
Code /
Developmen
t
Dependenci
es and
Libraries
Testing Integration
Deployment
Maintenance
and Updates
Security and
Compliance
End of Life

@spoole167
Code /
Developmen
t
Testing Integration
Deployment
Maintenance
and Updates
Security and
Compliance
End of Life
Dependenci
es and
Libraries

@spoole167
Code /
Developmen
t
Testing Integration
Deployment
Maintenance
and Updates
Security and
Compliance
End of Life
Dependenci
es and
Libraries
How many?

@spoole167
150 Dependencies (avg Java project)

@spoole167
10% Your code
90% someone else’s
Your Software Supply Chain …

@spoole167
What’s new in the
Software
Supply Chain World?

@spoole167
Open Source Adoption is growing

@spoole167
But so are the attacks

@spoole167
Understand the cyber-attack landscape.

@spoole167
In 2016 Cybercrime surpassed the drug trade!
$450 Billion a year
$14,000 a second
Equivalent to 50 US Nimitz Class Aircraft carriers
Cyber Crime Facts

@spoole167
In 2023!
$6 Trillion a year!
$200,000 a second
Equivalent to 620 US Nimitz Class Aircraft carriers
Cyber Crime Facts

@spoole167
United States: $20.89 trillion
China: $14.72 trillion
Cyber Crime : $6.0 trillion
Japan: $5.06 trillion
Germany: $3.85 trillion
United Kingdom: $2.67 trillion
India: $2.66 trillion
France: $2.63 trillion
Italy: $1.89 trillion
Canada: $1.64 trillion
https://globalpeoservices.com/top-15-countries-by-gdp-in-2022/
if Cybercrime
was a country
(by gdp)

@spoole167
Cybercrime has been growing at ~56% per year ever since
drug trade
cybercrime

@spoole167
There is no sign
of it slowing down
drug trade
cybercrime
US gdp
Cybercrime has been growing at ~56% per year ever since

@spoole167
Todays Pablo Escobar uses a Laptop

Cyber Attacks are rising in number and sophistication
Nation states are preparing for the next war – and that all about software
The aim is to infiltrate infrastructure and essential services…

And manipulate or terminate

A major target is
open source
projects and
supply chains

is still active

Open source
consumers are not
paying attention

Open source
consumers
assume
dependencies will
just ‘get fixed’
11% of all open source
projects are maintained
Only 6% of Javascript
16% of Java projects
are maintained

Where
’maintained’ = 1
update / 90 days
11% of all open source
Only 6% of Javascript
16% of Java projects
are maintained

It’s slightly more complicated
16% of Java projects that were maintained in 2022 are
no longer maintained in 2023
9.7% of Java projects that are maintained 2023 are
“newly maintained”
•21% of Javascript projects that were maintained in 2022
are no longer maintained in 2023
13% of Javascript projects that are maintained 2023 are
“newly maintained”
There’s a sense of
consolidation
around important
projects
happening

• The only time we consider
adding a dependency to
the supply chain is at
development
• Afterwards we just patch
it…
We need help to make better choices

top signs of a quality project? code reviews
and not checking binaries into a repo!

Governments are helping too
•United States National Cybersecurity Strategy (NCS)
•Securing Open Source Software Act of 2023
•AI for National Security Act:
•FDA Cybersecurity in Medical Devices
•SEC Regulation
•Cyber Strategy of the Department of Defense
•CISA Open Source Software Security Roadmap
•NHTSA Cybersecurity Best Practices for Modern Vehicles
•Cyber Resilience Act (CRA)
•Product Liability Directive (PLD)
•Network and Information Security Directive (NIS2)

Hardening the software supply chain : every product
has a SBOM
uses an automatic
supply chain process
has evidence of
software integrity
has evidence of
an automatic
vulnerability check
process
Has a vulnerability
disclosure program
Has evidence on the
providence of all software
used
Demonstrates strong
controls over the use of
internal and third-party
software and services
Demonstrate regular audit
processes

@spoole167
SBOM Requirements Are Spreading
https://www.sonatype.com/state-of-the-software-supply-chain

@spoole167
What Do you need to do if you produce any digital product? (1 of 2)
Security Requirements
➔ Designed, developed and produced to ensure an appropriate
level of cybersecurity based on the risks;
➔ Delivered without any known exploitable vulnerabilities;
➔ Be placed on the market delivered with a secure by default
configuration including a default setting that security updates be
installed automatically
➔ ensure protection from unauthorised access by appropriate control
mechanisms, including but not limited to authentication, identity or
access management systems;
➔ Encrypt relevant data at rest or in transit by state of the art
mechanisms;
➔ protect the integrity of data, personal or other, commands,
programs and configuration against any manipulation or
modification not authorised by the user, and report on corruptions
➔ Process only data that is limited to what is necessary in relation to
the intended use purpose of the product
➔ Protect the availability of essential functions, including the
resilience against and mitigation of denial of service attacks;
➔ Minimise their own negative impact on the availability of services
provided by other devices or networks;
➔ Reduce the impact of an incident using appropriate exploitation
mitigation mechanisms and techniques;
➔ Provide security related information by recording and/or monitoring
relevant activity, including the access to or modification of data,
services or functions;
➔ enable that vulnerabilities can be addressed through security
updates, including, where applicable, through automatic
updates by default
➔ Provide the possibility for users to securely and easily remove all
data and settings
“Products with digital elements and processes shall be presumed to be in conformity with the essential requirements set out in Annex I covered by those standards
or parts thereof. “
Sources:
Article 18
Annex I

@spoole167
What Do you need to do if you produce any digital product? (2 of 2)
Vulnerability Management Requirements
➔ Identify and document vulnerabilities and components
contained in the product, including by drawing up a software bill of
materials in a commonly used and machine readable format
covering at the very least the top-level dependencies of the
product; [You Need to produce SBOM]
➔ Address and remediate vulnerabilities without delay, including
by providing security updates;
➔ Publicly disclose information about fixed vulnerabilities,
including a description of the vulnerabilities, information allowing
users to identify the product affected, the impacts of the
vulnerabilities, their severity and clear and user friendly information
helping users to remediate the vulnerabilities
➔ Put in place and enforce a policy on coordinated vulnerability
disclosure;
➔ Provide a contact address for the reporting of the
vulnerabilities discovered in the product including third party
components
➔ Provide for mechanisms to securely distribute updates for
products with digital elements to ensure that exploitable
vulnerabilities are fixed or mitigated in a timely and, where
applicable, automatic manner;
➔ Ensure Security patches or updates are available to address
identified security issues, they are disseminated without
delay and free of charge, accompanied by advisory messages
Sources:
Article 18
Annex I

@spoole167
And there’s more …

@spoole167
Demand for LLM Libraries Is Growing
LLM Library Usage Over Time

@spoole167
Demand for ML Libraries Broadly Is Also Growing
Traditional ML Library Usage Over Time

@spoole167
Security and
Licencing for AI in
the supply chain is
a major concern
So is AI in the
hands of the bad
guys ..

@spoole167
What’s an ‘AI’ Software Supply Chain?
Models
Dependenci
es and
Libraries
Testing Integration
Deployment
Maintenance
and Updates
Security and
Compliance
End of Life
Code /
Developmen
t
Training
Evaluation
and
continuous
retraining
Legal
Governence
Provence
Control of AI
tools in the
process

@spoole167
Generative AI is here
“97% of 800 developers said
that they used generative AI in
their workflows.”
AI is not going to replace you -
but a developer using AI just
might ...

@spoole167
● Time to look at your software supply chains and the tools involved.
● Time to lean how Maven* can help
● Time to review the components – licenses, dependencies,
vulnerabilities AND other project metrics.
● Time to prune those old versions, obsolete projects
● Time to look at how you automate , how you trace the process. The
evidence you can produce
● Time to take a look at SBOMS and add them to your processes
● Time to look at the new legislation coming – especially CRA
● Time to lean how to use Chat GPT and other AI tools
● Time to be flexible and rise to the new world of AI and Legislation
Next Steps
news.apache.org/foundation/entry/save-open-
source-the-impending-tragedy-of-the-cyber-
resilience-act
eclipse-foundation.blog/2023/01/15/european-cyber-
resiliency-act-potential-impact-on-the-eclipse-
foundation/
linuxfoundation.eu/cyber-resilience-act

@spoole167
“The hottest new programming
language is English.”

Key Takeaways for Java Developers from the State of the Software Supply Chain Report

Recommended

Recommended

More Related Content

Similar to Key Takeaways for Java Developers from the State of the Software Supply Chain Report

Similar to Key Takeaways for Java Developers from the State of the Software Supply Chain Report (20)

More from Steve Poole

More from Steve Poole (20)

Recently uploaded

Recently uploaded (20)

Key Takeaways for Java Developers from the State of the Software Supply Chain Report