2024软件供应链安全风险现状报告组织的应对措施调查 英文版 .docxVIP

TheStateofSoftwareSupplyChainSecurityRisks

SponsoredbyBlackDuckIndependentlyconductedbyPonemonInstituteLLCPublicationDate:May2024

PonemonInstitute?ResearchReport

TheStateofSoftwareSupplyChainSecurityRisksPreparedbyPonemonInstituteMay2024

Part1.Introduction

Thepurposeofthisresearchistounderstandhowpreparedorganizationsareinreducingsoftwaresecurityrisksinthesupplychain.SponsoredbyBlackDuck,PonemonInstitutesurveyed1,278ITandITsecuritypractitionerswhoareinorganizationsthatarecommittedtoachievingasecuresoftwaresupplychainandhavesomelevelofresponsibilityfortheirorganizations’softwaresupplychainsecuritystrategy.TheregionsandcountryinthisresearchareNorthAmerica(613respondents),EMEA(362respondents)andJapan(303respondents).

AccordingtotheNationalInstituteofStandardsandTechnology(NIST),asoftwaresupplychainattackcanbeassophisticatedasmalwareinjectionorassimpleasanopportunisticexploitationofanunpatchedvulnerability.Themaliciouscodethenendsupinanorganization’ssystemandmayallowthehackertogainaccesstosensitivedataorcompromiseitscodetogainaccesstocustomers.Thismayresultinaransomwareattackorothermaliciousincidents.Typically,attackersfindaweaklinkinthesupplychainanduseittomoveuporacrossthesupplychaintotheirrealtargets.

Vulnerabilitiesaretherootcauseofattacksagainstmanyofthesoftwaresupplychainsinthisresearch.Fifty-ninepercentoforganizationsinthisresearchhavebeenimpactedbyasoftwaresupplychainattackorexploitand54percentoftheserespondentssaytheattackshappenedinthepastyear.

AsshowninFigure1,28percentofrespondentssaytherootcauseoftheattackorexploitwasanunpatchedopensourcevulnerabilitypreviouslydetectedand23percentofrespondentssayitwastheresultofazerodayvulnerability.Fiftypercentoftheseo