The survey reveals while 94% of executives believe there should be clear consequences (fines, greater legal liability for companies proven to be negligent) for software vendors that fail to protect the integrity of their software build pipelines, most have done little to change the way they evaluate the security of the software they purchase and the assurances they demand from software providers.
According to European Union Agency for Cybersecurity (Enisa), supply chain attacks on SolarWinds, Codecov and Kaseya, are expected to increase by a factor of four in 2021.
Executives are clearly much more concerned about their vulnerability to software supply chain attacks and aware of the urgent need for action. However, the survey results show that they are not taking action that will drive change.
The survey findings include:
• 97% of executives believe that software providers need to improve the security of their software build and code signing processes.
• 96% of executives think that software providers should be required to guarantee the integrity of the code in their software updates.
However, the survey pointed out:
• 55% of executives report that the SolarWinds hack has had little or no impact on the concerns they consider when purchasing software products for their company.
• 69% of executives say their company has not increased the number of questions they are asking software providers about the processes used to assure the security of their software and verify code.
Within their own organisations, executives have differing views on who is responsible for improving the security within their own software development organisations, with 48% saying IT security is responsible and 46% saying development teams are responsible.
“There is a clear disconnect between concern about supply chain attacks and improving security controls and processes to mitigate this risk,” explains Venafi vice president of security strategy and threat intelligence Kevin Bocek.
“Executives are right to be concerned about the impact of supply chain attacks. These attacks present serious risks to every organisation that uses commercial software and are extremely difficult to defend against. To address this systemic problem, the entire technology industry needs to change the way we build and buy software,” Bocek concludes. “Executives can’t treat this as just another technical problem—it’s an existential threat. C-level executives and boards need to demand that security and development teams for software vendors provide clear assurance about the security of their software.”
For more information about the survey, click here.