Communications of the ACM
OSS Supply-Chain Security: What Will It Take?
Credit: Andrij Borys Associates, Shutterstock
While enterprise security teams naturally tend to turn their focus primarily to direct attacks on their own infrastructure, cybercrime exploits now are increasingly aimed at easier targets upstream—within the open source software supply (OSS) chains that enterprises and other organizations have come to rely upon.
This has led to a perfect storm, since virtually all significant codebase repositories at this point include at least some amount of open source software, given that is where a wealth of innovation is available to be tapped. But opportunities also abound there for the authors of malware, since it's a setup they can leverage to spread the seeds of their exploits far and wide.
No entries found