S3C2 Summit 2023-11: Industry Secure Supply Chain Summit

TL;DR

The paper documents the Industry Secure Supply Chain Summit (November 16, 2023) organized by the NSF-supported S3C2 program to surface practitioner insights on securing the software supply chain. Through a keynote and six panel discussions with 13 industry practitioners from 11 companies and 3 researchers, the summit covers SBOM adoption, vulnerable dependencies, malicious commits, build infrastructure, scaling vulnerable classes of vulnerabilities, and culture changes, all within a dialogue framework designed to share lessons learned and identify research opportunities. Key findings highlight practical challenges in SBOM generation and sharing, the complexity of vulnerability management, the need for robust build provenance and reproducible builds, and the critical role of executive support and culture in enabling secure software development. The discussions illuminate actionable pathways for industry and policy, including standardization efforts, trusted-build workflows, and incentives to accelerate the adoption of memory-safe languages and secure development practices in both proprietary and open-source ecosystems, aligned with national cybersecurity priorities under EO 14028.

Abstract

Cyber attacks leveraging or targeting the software supply chain, such as the SolarWinds and the Log4j incidents, affected thousands of businesses and their customers, drawing attention from both industry and government stakeholders. To foster open dialogue, facilitate mutual sharing, and discuss shared challenges encountered by stakeholders in securing their software supply chain, researchers from the NSF-supported Secure Software Supply Chain Center (S3C2) organize Secure Supply Chain Summits with stakeholders. This paper summarizes the Industry Secure Supply Chain Summit held on November 16, 2023, which consisted of \panels{} panel discussions with a diverse set of \participants{} practitioners from the industry. The individual panels were framed with open-ended questions and included the topics of Software Bills of Materials (SBOMs), vulnerable dependencies, malicious commits, build and deploy infrastructure, reducing entire classes of vulnerabilities at scale, and supporting a company culture conductive to securing the software supply chain. The goal of this summit was to enable open discussions, mutual sharing, and shedding light on common challenges that industry practitioners with practical experience face when securing their software supply chain.