Supply Chain Security Experience

Rate this content

Developers are flooded with tools and worries provided by security vendors. From researchers finding theoretical attacks, to time spent dealing with package updates, to simple accidents causing downtime all of these exist. Taking some history into account to understand the basic categories of attacks and how practical they are to exploit or even how common they are will give some assurance and guidance on where a developer can focus their limited energy and get the most out of their efforts.

8 min
17 Apr, 2023


Sign in or register to post your comment.

AI Generated Video Summary

Supply chain security is important in software development, and it's crucial to assess the actual impact of threats. When dealing with security vendors, ask practical questions about vulnerabilities and impacts. Focus on quality signal and noise ratios when considering the number of dependencies. Ongoing conversations with vendors are important to address concerns. Stay informed and make informed decisions.

1. Introduction to Supply Chain Security

Short description:

Hi, I'm Bradley Farias. I work at Socket on Supply Chain Security. Supply Chain refers to the network of people, tools, and dependencies that come together to build software. Security vendors often exaggerate the risks and try to make you panic. It's important to ask questions and assess the actual impact of the threats. When considering security, focus on your application, its dependencies, and the consumers. At Socket, we prioritize defending against dependencies and the risks they introduce. Understanding what the security vendor offers and tailoring it to your needs is crucial.

Hi, I'm Bradley Farias. I work at Socket on Supply Chain Security, and I want to talk to you a little bit about experience of doing so and how to not be overwhelmed by all these security people trying to talk to you about their wonderful products and all the chaotic mess that we have.

So Supply Chain just means a network of different people, of different tools, different dependencies, all coming together to make your application for software. People want to blow this out of proportion, oh this network is ever expanding and stuff like that. And it is large, especially in JavaScript. The average dependency might have around 80 dependencies, what we're seeing at work today. So whenever you pull in a dependency in your package.json for node, you're actually pulling in around 81 on average. Because each dependency may have another dependency. Which is a little bit scary to think about, but it's just the reality of the nature of building software these days. Everybody's working together. And that means our supply chain is very large.

This has security people and security vendors wanting you to panic. They want you to think that all sorts of things are vulnerable. Any sort of attack, everywhere, even the most minute kind of attack, is something you must be vigilant against. You must spend thousands and thousands of your money to just defend against something when in reality if you ask some questions. Who can actually perform the attack? What can the attack do? Where can the attack actually be performed? And these kind of things. You might notice that, okay, we can invest in these things that the security vendor has said are the most important things, but the impact of them is very small. And so it may be the case that all these security threats that are being identified, that are shown to you by these security vendors are impractical, or just don't do anything to what you have.

So when you think about this, you need to think about your application, the dependencies in your application, and the consumers of your application. And who is the security vendor actually doing something for? Are they preventing consumers from doing something bad to your application? Are they preventing dependencies from exposing dangers to your application? For our work at Socket, we are mostly focused on your dependencies. We have a high level of trust on your application. And that's not to say it's the only thing we defend against, but a lot of the time, when you are working with dependencies, you don't read their source code. You don't know what happens when you update your dependencies. They could pull in a new dependency, and when that dependency updates, pulling in a new dependency could introduce a backdoor. It could introduce a problematic script that runs on your development machine, on your build server, and stuff like that. A lot of this is about trying to figure out what the security vendor is providing for you. What the security vendor is trying to tailor their experience for. They could be informative. They are trying to tell you, this thing that you installed has 80 dependencies within it. You're not installing one when you add it to your package JSON.

2. Asking Security Vendors the Right Questions

Short description:

You need to ask security vendors practical questions about vulnerabilities, scenarios, and impacts. Don't be overwhelmed by the number of dependencies; focus on quality signal and noise ratios. Ensure that vendors have answers for incidents and preventive measures. Have ongoing conversations with vendors to address concerns. Demo time is limited, but stay informed and make informed decisions.

You're actually installing 81 packages. They may be proactive. They might try to prevent you from installing something. Oh, this install will cause you to have an install script. The install script looks a little bit scary. Let's back off.

So they could be proactive about security, or they could be reactive. Oh, we saw that this vulnerability occurred. These are the steps you could do to identify what happened. What was vulnerable when and what data was affected by it. You need to ask these questions when you're talking to security vendors. And ask about scenarios, practical ones.

Figure.js, Event Stream, Lettpad, these are all very famous. I have a great deal of hope that every security vendor you talk to has at least some basic answer for what would occur when using their tool, if their tool even affects those scenarios. These have academic papers written on these events, these are in Wikipedia articles and stuff like that. Or any theoretical scenarios that you can come up with.

But a lot of these come down to a famous xkcd. A random person is hidden within your dependencies. You don't know who this random person is. They're so deep down in there, their dependency is so deep down in there that when they have a problem, when they introduce risk malicious scripts into your codebase, you may not be able to see it. And these tools are trying to expose that. And it seems overwhelming.

Oftentimes when you have hundreds and hundreds of dependencies, you may only have a few that are risky. So don't be overwhelmed by numbers. Get quality signal and noise ratios so that you can actually do an informed decision. And the impact. When you're talking to these vendors, they may show you a great demo, but they definitely need to have answers to what happens if there is an incident. Is it going to take down your production machine? Is it going to cause problems for you as a business? And how much effort is it going to take for a developer when they're waiting on a fix to keep the production machines alive? What can you do after it? You've fixed it, but is there anything that the tool can do to prevent the next incident? And you need to go and have that conversation repeatedly. And hopefully the vendors have an answer for you. That's all. Don't get overwhelmed. Everybody's trying to show the value of their product as fast as they can because we have a very short amount of time when we're demoing things. Yes, it will all be good.

Check out more articles and videos

We constantly think of articles and videos that might spark Git people interest / skill us up or help building a stellar career

Node Congress 2022Node Congress 2022
26 min
It's a Jungle Out There: What's Really Going on Inside Your Node_Modules Folder
Do you know what’s really going on in your node_modules folder? Software supply chain attacks have exploded over the past 12 months and they’re only accelerating in 2022 and beyond. We’ll dive into examples of recent supply chain attacks and what concrete steps you can take to protect your team from this emerging threat.
You can check the slides for Feross' talk

JSNation 2023JSNation 2023
30 min
The State of Passwordless Auth on the Web
Can we get rid of passwords yet? They make for a poor user experience and users are notoriously bad with them. The advent of WebAuthn has brought a passwordless world closer, but where do we really stand?
In this talk we'll explore the current user experience of WebAuthn and the requirements a user has to fulfill for them to authenticate without a password. We'll also explore the fallbacks and safeguards we can use to make the password experience better and more secure. By the end of the session you'll have a vision for how authentication could look in the future and a blueprint for how to build the best auth experience today.
React Advanced Conference 2021React Advanced Conference 2021
22 min
Let Me Show You How React Applications Get Hacked in the Real-World
Modern frontend frameworks like React are well thought-of in their application security design and that’s great. However, there is still plenty of room for developers to make mistakes and use insecure APIs, vulnerable components, or generally do the wrong thing that turns user input into a Cross-site Scripting vulnerability (XSS). Let me show you how React applications get hacked in the real-world.

JSNation Live 2021JSNation Live 2021
9 min
Securing Node.js APIs with Decentralised Identity Tokens
Authentication and Authorization are serious problems. We often dedicate a lot of time to craft powerful APIs but overlook proper security measures. Let's solve it with Magic using a key-based identity solution built on top of DID standard, where users’ identities are self-sovereign leveraging blockchain public-private key pairs. In this talk, we’ll look at proper ways to secure our Node.js APIs with Decentralised Identity Tokens. We’ll go from learning what Decentralised Identity standards are, how the users’ identities are self-sovereign leveraging blockchain public-private key pairs, why they’re the future of API security, and to put theory into practice we will build a real-world implementation using Node.js where I’ll show common best practices.

JSNation 2023JSNation 2023
22 min
5 Ways You Could Have Hacked Node.js
All languages are or were vulnerable to some kind of threat. I’m part of the Node.js Security team and during the year 2022, we've performed many Security Releases and some of them were really hard to think about.
Did you know you can make money by finding critical vulnerabilities in Node.js? In this talk, I’ll show you 5 ways you can have hacked Node.js and how the Node.js team deals with vulnerabilities.

Workshops on related topic

React Summit 2023React Summit 2023
56 min
0 to Auth in an hour with ReactJS
Passwordless authentication may seem complex, but it is simple to add it to any app using the right tool. There are multiple alternatives that are much better than passwords to identify and authenticate your users - including SSO, SAML, OAuth, Magic Links, One-Time Passwords, and Authenticator Apps.
While addressing security aspects and avoiding common pitfalls, we will enhance a full-stack JS application (Node.js backend + React frontend) to authenticate users with OAuth (social login) and One Time Passwords (email), including:
- User authentication - Managing user interactions, returning session / refresh JWTs
- Session management and validation - Storing the session securely for subsequent client requests, validating / refreshing sessions
- Basic Authorization - extracting and validating claims from the session token JWT and handling authorization in backend flows
At the end of the workshop, we will also touch other approaches of authentication implementation with Descope - using frontend or backend SDKs.
JSNation 2022JSNation 2022
99 min
Finding, Hacking and fixing your NodeJS Vulnerabilities with Snyk
npm and security, how much do you know about your dependencies?
Hack-along, live hacking of a vulnerable Node app, Vulnerabilities from both Open source and written code. Encouraged to download the application and hack along with us.
Fixing the issues and an introduction to Snyk with a demo.
Open questions.
DevOps.js Conf 2022DevOps.js Conf 2022
76 min
Bring Code Quality and Security to your CI/CD pipeline
In this workshop we will go through all the aspects and stages when integrating your project into Code Quality and Security Ecosystem. We will take a simple web-application as a starting point and create a CI pipeline triggering code quality monitoring for it. We will do a full development cycle starting from coding in the IDE and opening a Pull Request and I will show you how you can control the quality at those stages. At the end of the workshop you will be ready to enable such integration for your own projects.

TestJS Summit 2021TestJS Summit 2021
111 min
JS Security Testing Automation for Developers on Every Build
As a developer, you need to deliver fast, and you simply don't have the time to constantly think about security. Still, if something goes wrong it's your job to fix it, but security testing blocks your automation, creates bottlenecks and just delays releases...but it doesn't have to...
NeuraLegion's developer-first Dynamic Application Security Testing (DAST) scanner enables developers to detect, prioritise and remediate security issues EARLY, on every commit, with NO false positives/alerts, without slowing you down.
Join this workshop to learn different ways developers can access Nexploit
start scanning without leaving the terminal!
We will be going through the set up end-to-end, whilst setting up a pipeline, running security tests and looking at the results.
Table of contents:
- What developer-first DAST (Dynamic Application Security Testing) actually is and how it works
- See where and how a modern, accurate dev-first DAST fits in the CI/CD
- Integrate NeuraLegion's Nexploit scanner with GitHub Actions
- Understand how modern applications, APIs and authentication mechanisms can be tested
- Fork a repo, set up a pipeline, run security tests and look at the results

DevOps.js Conf 2022DevOps.js Conf 2022
32 min
Passwordless Auth to Servers: hands on with ASA
These days, you don't need a separate password for every website you log into. Yet thanks to tech debt and tradition, many DevOps professionals are still wrangling a host of SSH keys to access the servers where we sometimes need to be. With modern OAuth, a single login and second factor to prove your identity are enough to securely get you into every service that you're authorized to access. What if SSHing into servers was that easy? In this workshop, we'll use Okta's Advanced Server Access tool (formerly ScaleFT) to experience one way that the dream of sending SSH keys the way of the password has been realized.
- we'll discuss how ASA works and when it's the right tool for the job
- we'll walk through setting up a free trial Okta account to use ASA from, and configuring the ASA gateway and server on Linux servers
- we'll then SSH into our hosts with the ASA clients without needing to supply an SSH key from our laptops
- we'll review the audit logs of our SSH sessions to examine what commands were run