Recent cybersecurity breaches have highlighted the resulting economic, political, and social effects. These incidents highlight that cybersecurity is now a supply chain issue. This should not be su...

New challenges in supply chain management: cybersecurity across the supply chain

The widespread dependency on open-source software makes it a fruitful target for malicious actors, as demonstrated by recurring attacks. The complexity of today’s open-source supply chains results in a significant attack surface, giving attackers numerous opportunities to reach the goal of injecting malicious code into open-source artifacts that is then downloaded and executed by victims.This work proposes a general taxonomy for attacks on open-source supply chains, independent of specific programming languages or ecosystems, and covering all supply chain stages from code contributions to package distribution. Taking the form of an attack tree, it covers 107 unique vectors, linked to 94 real-world incidents, and mapped to 33 mitigating safeguards.User surveys conducted with 17 domain experts and 134 software developers positively validated the correctness, comprehensiveness and comprehensibility of the taxonomy, as well as its suitability for various use-cases. Survey participants also assessed the utility and costs of the identified safeguards, and whether they are used.

SoK: Taxonomy of Attacks on Open-Source Software Supply Chains

: Data cooperative (called “data coop” for short) is an emerging approach in the area of secure data management. It promises its users a better protection and control of their data, as compared to the traditional way of their handling by the data collectors (such as governments, big data companies, and others). However, for the success of data coops, existing challenges with respect to data management systems need to be adequately addressed. Especially, they concern terms of security and privacy, as well as the power imbalance between providers/owners and collectors of data. Designing a security and privacy model for a data coop requires a systematic threat modeling approach that identiﬁes the security landscape, attack vectors, threats, and vulnerabilities, as well as the respective mitigation strategies. In this paper, we analyze the security of data cooperatives, identify potential security risks and threats, and suggest adequate countermeasures. We also discuss existing challenges that hinder the widespread adoption of data coops.

Towards a Threat Model and Security Analysis for Data Cooperatives

Risk-based authentication (RBA) aims to protect users against attacks involving stolen passwords. RBA monitors features during login, and requests re-authentication when feature values widely differ from those previously observed. It is recommended by various national security organizations, and users perceive it more usable than and equally secure to equivalent two-factor authentication. Despite that, RBA is still used by very few online services. Reasons for this include a lack of validated open resources on RBA properties, implementation, and configuration. This effectively hinders the RBA research, development, and adoption progress. To close this gap, we provide the first long-term RBA analysis on a real-world large-scale online service. We collected feature data of 3.3 million users and 31.3 million login attempts over more than 1 year. Based on the data, we provide (i) studies on RBA’s real-world characteristics plus its configurations and enhancements to balance usability, security, and privacy; (ii) a machine learning–based RBA parameter optimization method to support administrators finding an optimal configuration for their own use case scenario; (iii) an evaluation of the round-trip time feature’s potential to replace the IP address for enhanced user privacy; and (iv) a synthesized RBA dataset to reproduce this research and to foster future RBA research. Our results provide insights on selecting an optimized RBA configuration so that users profit from RBA after just a few logins. The open dataset enables researchers to study, test, and improve RBA for widespread deployment in the wild.

/pdf/pump-up-password-security-evaluating-and-enhancing-risk-8iqhg5cf.pdf

Pump Up Password Security! Evaluating and Enhancing Risk-Based Authentication on a Real-World Large-Scale Online Service

Incident response playbooks provide step-by-step guidelines to help security operations personnel quickly respond to specific threat scenarios. Although playbooks are common in the security industry, they have not been empirically evaluated for effectiveness. This paper takes a first step toward measuring playbooks and the frameworks used to design them, using two studies conducted in an enterprise environment. In the first study, twelve security professionals created two playbooks each, using two standard playbook design frameworks; the resulting playbooks were evaluated by experts for accuracy. In the second, we observed five personnel using the created playbooks in no-notice threat exercises within a live security-operations center. We find that playbooks can help simplify and support incident response efforts. However, playbooks designed using the frameworks we examined often lack sufficient detail for real-world use, particularly for more junior technicians. We provide recommendations for improving playbooks, playbook frameworks, and organizational processes surrounding playbook use.

/pdf/how-ready-is-your-ready-assessing-the-usability-of-incident-1dv117lp.pdf

How Ready is Your Ready? Assessing the Usability of Incident Response Playbook Frameworks

As any other US software maker, Microsoft is bound by the “Executive Order on Improving the Nation's Cybersecurity” [2] which dictates a clear mandate to “enhance the software supply chain security” and to generally improve the cyber security practices. However, this is much easier written down than enforced. The executive order imposes new rules and requirements that will impact engineering practices and evidence collection for most projects and engineering teams in a relatively short period of time. Part of the response is the requirement to build up comprehensive inventories of software artifacts contributing to US government systems, which is a massive task when done manually would be tedious and fragile as software eco-systems change rapidly. Required is a system that will constantly monitor and update the inventory of software artifacts and contributors so that at any given point of time, the scope and involved teams for any software security incident can be notified and response plans activated. The front line of this security battle includes data mining platforms providing the security and compliance teams with engineering artifacts and insights into artifact dependencies and engineering practices of the corresponding engineering teams. The data provided does not only allow Microsoft to build an accurate engineering artifact inventory, but also enables Microsoft�s teams to initiate so called “get-clean” initiatives to start issue remediation before proper policy tools and pipelines (“stay-clean”) can be developed, tested, and deployed. In this talk we will present CloudMine1, one of Microsoft's main data mining platforms serving data sets and dependency graphs of more than 270 different engineering artifacts (e.g., builds, releases, commits, pull requests, etc.) gathered on an hourly basis. During the talk we will provide some insights into CloudMine, its engineering team and operational costs-which is significant. We will then highlight the benefits and opportunities a data mining framework like CloudMine provides the company including insights into how inventory and automation bots use CloudMine data to impact thousands of Microsoft engineers daily, saving the company significant costs and response times to security incidents: the ability to scan more than 100,000 code repositories across the enterprise within hours; building up an artifact engineering inventory enabling us to flag any known security vulnerability in any of the software components within hours; or spotting non-compliant build and release pipelines across Microsoft's 500,000 pipelines. In addition, we will also present open challenges the CloudMine engineering team is facing during operating and growing CloudMine as a platform, which will hopefully provide motivation and inspiration for researcher and other companies to start a dialog with us and other companies about these challenges and latest research results that may help us solve these issues. From the talk it should become clear that running enterprise scale systems is not cheap but worth the effort as it enables Microsoft and its engineering teams to respond to current cyber security threads even before we can build and test best in class built-in defense systems.

https://dl.acm.org/doi/pdf/10.1145/3524842.3528514

Myles McLeroy

Papers

Microsoft CloudMine: Data Mining for the Executive Order on Improving the Nation's Cybersecurity