Google Cloud provides a comprehensive and modular set of capabilities and tools across Google Cloud products that your developers, DevOps, and security teams can use to improve the security posture of your software supply chain.
Software supply chains
A software supply chain consists of all the code, people, systems, and processes that contribute to development and delivery of your software, both inside and outside of your organization. It includes:
- Code you create, its dependencies, and the internal and external software you use to develop, build, package, install, and run your software.
- Processes and policies for system access, testing, review, monitoring and feedback, communication, and approval.
- Systems you trust to develop, build, store, and run your software and its dependencies.
Given the broad reach and complexity of software supply chains, there are numerous ways to introduce unauthorized changes to the software that you deliver to your users. These attack vectors span the software lifecycle. While some attacks are targeted, such as the attack on the SolarWinds build system, other threats are indirect or enter the supply chain through weaknesses in process or neglect.
For example, an assessment of the
Apache Log4j vulnerability in December 2021 by the
Google Open Source Insights team found that there were over 17,000 affected
packages in Maven Central. Most of these packages did not depend directly
on the vulnerable log4j-core package, but had dependencies that required the
package.
Development practices and processes also impact software supply chains. Process gaps such as lack of code review or security criteria for deployment to production can allow bad code to unintentionally enter the supply chain. Similarly, lack of dependency management increases the risk of vulnerabilities from external source or software packages that you use for development, builds, or deployment.
Safeguard software supply chains on Google Cloud
Google Cloud provides:
- Products and features that incorporate security best practices for development, building, testing, deployment, and policy enforcement.
- Dashboards in the Google Cloud console that provide security information about source, builds, artifacts, deployments, and runtimes. This information includes vulnerabilities in build artifacts, build provenance, and Software Bill of Materials (SBOM) dependency lists.
- Information identifying the maturity level of your software supply chain security using the Supply-chain Levels for Software Artifacts (SLSA) framework.
The following diagram shows Google Cloud services that work together to protect the software supply chain. You can integrate some or all of these components into your software supply chain to improve your security posture.