91 percent of organizations experience software supply chain incidents

The overwhelming majority of organizations (91 percent) have experienced a software supply chain incident in the past 12 months, according to a new report.

The study from Data Theorem and the Enterprise Strategy Group surveyed over 350 respondents from private- and public-sector organizations in the US and Canada across cybersecurity professionals, application developers and IT professionals.

It reveals the most common security incidents over this period as: zero-day exploit on vulnerabilities within third-party code (41 percent), misconfigured cloud service exploits (40 percent), vulnerability exploits in open-source software and container images (40 percent), secrets/token/passwords stolen from source code repositories (37 percent), and API data breaches in third-party software and code (35 percent).

The survey also shows 88 percent of organizations feel it's critical or important to have an accurate inventory of their third-party APIs and cloud services as it relates to software supply chain security. This is followed by 86 percent of organizations saying it's critical or important to know the composition/inventory of application code in use.

"Because of the massive number of suppliers and partners, continuous discovery of components across the software supply chain is a major challenge; in fact from our survey the overwhelming majority (88 percent) of organizations state the importance and criticality of having an accurate inventory of their third-party APIs and cloud services," says Melinda Marks, practice director, cybersecurity at Enterprise Strategy Group. "While it's understood SBOMs are important to software supply chain security, most organizations are challenged with creating and maintaining current SBOMs. Organizations need continuous runtime scanning, discovery and inspection of open-source components, third-party libraries, and APIs in source code to best secure their applications."

Top priorities for investments in supply chain security over the next 12 to 18 months include: scanning open source code components and third-party libraries for vulnerabilities (44 percent), followed by discovering and inspecting APIs in source code (39 percent), and creating a SBOM via composition analysis (38 percent). More than a third of organizations see investing in applying runtime API security controls as a top priority.

The full report is available from the Data Theorem site.

Image credit: Chan2545/depositphotos.com