Moving Toward a More Transparent Software Supply Chain
Earlier this month, NTIA convened the latest in a series of multistakeholder meetings on software component transparency. For more than a year, stakeholders have been exploring this issue through four working groups established during the July 2018 kickoff meeting. The broader community meets periodically to share progress and encourage feedback through in-person and virtual meetings.
Most modern software is not written completely from scratch, but includes existing components, modules, and libraries from the open source and commercial software world. Modern development practices such as code reuse, and a dynamic IT marketplace with acquisitions and mergers, make it challenging to track the use of software components.
The Internet of Things and the emergence of Cyber-Physical Systems, which integrate computation, networking, and physical processes, compound this phenomenon, as new organizations, enterprises and innovators take on the role of software developer to add “smart” features or connectivity to their products. Although the majority of libraries and components do not have known vulnerabilities, the sheer quantity of software means that some software products ship with vulnerable or out-of-date components.