Secure Supply Chain Management in DevOps: Addressing Software Bill of Materials (SBOM) Risks

The software supply chain is becoming a widespread analogy to designate the series of steps taken to go from source code published by developers to executables running on the users? computers. A security vulnerability in any of these steps puts users at risk, and evidence shows that attacks on the supply chain are becoming more common. The consequences of an attack on the software supply chain can be tragic in a society that relies on many interconnected software systems, and this has led research interest as well as governmental incentives for supply chain security to rise. GNU Guix is a software deployment tool and software distribution that supports provenance tracking, reproducible builds, and reproducible software environments. Unlike many software distributions, it consists exclusively of source code: it provides a set of package definitions that describe how to build code from source. Together, these properties set it apart from many deployment tools that center on the distribution of binaries. This paper focuses on one research question: how can Guix and similar systems allow users to securely update their software? Guix source code is distributed using the Git version control system; updating Guix-installed software packages means, first, updating the local copy of the Guix source code. Prior work on secure software updates focuses on systems very different from Guix -- systems such as Debian, Fedora, or PyPI where updating consists in fetching metadata about the latest binary artifacts available -- and is largely inapplicable in the context of Guix. By contrast, the main threats for Guix are attacks on its source code repository, which could lead users to run inauthentic code or to downgrade their system. Deployment tools that more closely resemble Guix, from Nix to Portage, either lack secure update mechanisms or suffer from shortcomings. Our main contribution is a model and tool to authenticate new Git revisions. We further show how, building on Git semantics, we build protections against downgrade attacks and related threats. We explain implementation choices. This work has been deployed in production two years ago, giving us insight on its actual use at scale every day. The Git checkout authentication at its core is applicable beyond the specific use case of Guix, and we think it could benefit to developer teams that use Git. As attacks on the software supply chain appear, security research is now looking at every link of the supply chain. Secure updates are one important aspect of the supply chain, but this paper also looks at the broader context: how Guix models and implements the supply chain, from upstream source code to binaries running on computers. While much recent work focuses on attestation -- certifying each link of the supply chain -- Guix takes a more radical approach: enabling independent verification of each step, building on reproducible builds, "bootstrappable" builds, and provenance tracking. The big picture shows how Guix can be used as the foundation of secure software supply chains.

With the development of the information technology industry and the expansion of software development requirements, the scale and complexity of software are increasing, which makes the software development process turn into a software supply chain with superior or subordinate relationships. However, due to the inherent fragility of the software supply chain and the uneven quality of third-party open-source software, accidents occur frequently, and the security of the software supply chain has received extensive attention. We first figure out the security risks faced by the software supply chain and then innovatively proposes a software supply chain management system based on blockchain. To the best of our knowledge, this is the first blockchain-based software supply chain management system. The transfer processes of all third-party components or software products in the system are permanently recorded in the distributed ledger through smart contracts, which become the basis when handling and tracking software supply chain security incidents.

In the new dynamic economic environment where supply chains increasingly face constant change and instability, the better supply chain planning and management enabled by advanced data management systems provides enhanced value proposition for customers resulting in improved profitability for firms along the supply chain. However, achieving such high quality level of supply chain visibility is not an easy task requiring technological capability, organizational willingness and data quality management intensively demanding attention from both managers and scholars. Therefore, the chapter begins with an overview of the role of information systems in supply chain management followed by a discussion regarding the role of information quality in successful supply chain interactions. Data quality management in terms of strategy and data governance is then reviewed. Finally, data quality tools complementing strategy dimension of data quality management are studied.

Software supply chain security has now become a critical concern in the software industry (and beyond) following the large impact of recent attacks: hackers injected malicious code into Solarwinds components and Octopus scanner, which eventually infected a wide range of downstream dependencies, affecting a massive number of users. Since supply chain vulnera-bilities are a well-known concern, especially with open source systems, approaches in the literature mainly focus on identifying and patching such vulnerability. Frequently, however, a vulnerability patch is not immediately propagated to earlier releases that have been inherited by dependents, leaving residual vulnerabilities in supply chains. Our work addresses this challenge and develops a simple approach to iteratively explore the attack surface of supply chain residual vulnerabilities in open source projects. We have assessed our search scheme on 50 GitHub-hosted projects having high stars and forks: we mine their bug fix commits and identify buggy package versions to track the affected dependents and estimate the potential attack surface. We find that many projects fix their vulnerable issues by update their dependency versions, and version inheritance is a significant cause of supply chain attacks for open source projects.

Knowledge-based, nonphysical (or intangible) products such as software and information and financial services present a different set of supply chain management challenges than those encountered by manufacturers of tangible products. Yet as intangible product manufacturers have developed more complex service and quality characteristics in their product-service bundles, they have adopted the supply chain practices of physical product manufacturers. One of the most salient differences between the two types of manufacturing is the reliance of intangible producers on collaboration and partnering with customers and suppliers created as a result of the reexamination of make-versus-buy decisions for nearly all components and services. This study focuses on software firms to identify and understand how these changes affect firm behavior. Contrary to our expectations, software firms do not fully exploit risk-sharing (teaming) alliances. We attempt to explain this via the lenses of trust and asset specialization between supply chain partners.

Recent catastrophic events and risks which have disrupted economies and supply chains around the world create new avenues/agendas for supply chain risks and security. Researcher and practitioner are showing increasing research interest on this area. This research has an effort to identified key factors and relation in supply chain risks and security and development of research framework. Given the increasing awareness of this important topic, the purpose of this research is to study supply chain critical risks important for supply chain security perspective and to investigate the relationship between supply chain vulnerability and supply chain risk. Interpretive structural modelling (ISM) has emerged as a means to analyse the relational aspects of the variables. The objective of this paper is to identify critical enablers of supply chain security management and to establish and analyse relationships among these enables using interpretive structural modelling. This research is continuing in this direction.

A coordination mechanism for supply chains with capacity expansions and order-dependent lead times

The rapid advancement of technology has made it imperative for supply chains to adapt to the changing landscape. Blockchain technology holds immense potential to transform supply chain processes, but the challenge lies in identifying the most suitable blockchain characteristics to meet the various performance indicators of a supply chain. To overcome this challenge, this study aims to prioritize the most critical blockchain characteristics in a supply chain. The study adopts a two-stage Quality Function Deployment (QFD) methodology to rank blockchain characteristics based on supply chain and software requirements. The methodology evaluates the supply chain performance indicators using the Supply Chain Operations Reference (SCOR) model and software needs using the International Organization for Standardization (ISO) software quality characteristics. After determining the problematic SCOR and ISO software-related metrics, the study utilizes the QFD Stage 1 to obtain the weights of ISO software characteristics and employs the Fuzzy Cognitive Map (FCM) to determine the most crucial blockchain characteristics for QFD Stage 2. The results of this study show that the top priorities for blockchain characteristics in a supply chain are smart contract functionality, privacy, transaction per second, tokenization, security, permissioned network, scalability, cost, modularity, and licensing, in order of importance.

Em ambientes globais e altamente competitivos, as cadeias de suprimentos tem como desafio contribuir nos processos de geracao de valor ao cliente e ao acionista, oferecendo nivel de servico elevado e custos totais baixos, bem como retorno satisfatorio ao investimento. Para este fim, a literatura tem proposto a conformacao ou configuracao de cadeias de suprimentos denominadas de “ leagile ”. Esta nova configuracao foi denominada por Naylor, Naim e Berry (1999) de “ leagility ”, por combinar vantagens do pensamento lean encontrado nas cadeias de suprimentos lean (CSL) e da agilidade por meio do conhecimento de mercado e habilidade para responder a demandas cada vez mais flexiveis, elementos que caracterizam a cadeia de suprimentos agil (CSA). A esta perspectiva teorica sao associados outros dois conceitos, o do posicionamento do decoupling point – DCP (ponto de desacoplamento) e postponement (postergacao). Contudo, para se indicar as cadeias de suprimentos leagile como alternativa estrutural para geracao de valor, faz-se necessario desenvolver estudo que vislumbre sua caracterizacao e o modo como podem promover a geracao de valor. Neste sentido, o presente estudo tem como objetivo, a partir de uma pesquisa bibliografica, descrever elementos e praticas que caracterizam cadeias de suprimentos leagile e suas possibilidades de geracao de valor. Como principais resultados, a pesquisa indicou que resposta rapida e oferta diversificada de produtos, associadas a diminuicao de lead time, de defeitos e de custo, sao alguns dos itens que possibilitam geracao de valor em uma cadeia leagile aos clientes e acionistas. O estudo oferece contribuicoes tanto para o conhecimento academico quanto para o pratico e seu aprofundamento aponta para pesquisas futuras de carater empirico.

LT variance or LT mean reduction in supply chain management: Which one has a higher impact on SC performance?

This article reviews the technological capabilities offered by the portal industry's key software vendors to support inter-firm design collaboration and supply chain integration. An analysis of the technology coverage and gaps is presented, with a focus on the opportunities available for portal software improvement. Challenges for collaboration and supply chain software, including security, external access and capabilities, bandwidth and communication standards are discussed, particularly in context with the demands of portal software users. As well, a picture of the current and future state of the marketplace is developed from an analysis of the market position and product direction of a selection of eight enterprise portal vendors.

Involvement of controllable lead time and variable demand for a smart manufacturing system under a supply chain management

Evaluation of cycle-count policies for supply chains with inventory inaccuracy and implications on RFID investments

Time is the bottle-neck element in agile operation supply chaine. The paper establishes the Stackelberg model of supply chain between upstream and downstream, it focus on discuss the costs decision-making considering the cost sharing of shorten lead time, delay penalty cost of lead time, order quantity and the supply chain cost. It shows that there exist equilibrium strategy about optimal delivery lead time and order quantity. We also analyze the effect that some decision-making factor impact on the supply chain decision-making.

The goal of traditional supply chain spare parts management is to maintain a minimum level of spare parts inventory whilst still being able to fulfil demand and maintain customer satisfaction. Much research has been undertaken to optimise product flow and optimise stock levels generally requiring transporting spare parts to the point of use from a centralised storage location. While moving from a decentralised to a centralised network can lower costs and improve service performance it will have a negative impact on the environment due the increase in transportation needs. It has been recognised that Additive Manufacturing (AM) technologies have the potential to positively disrupt the supply chain by reducing the requirement to hold and transport stock, produce cost and lead time savings, while also guarding against supply chain disruption. This paper reports on the outcomes of a joint research project conducted between Bournemouth University (BU) and the Royal National Lifeboat Institution (RNLI) to identify specific areas where additive manufacturing could be implemented into the organisation to have a positive impact on the supply chain and promote responsible innovation in their component design. The RNLI is a charity which operates using donations from members of the public and believe it imperative to produce efficiency across all areas of the organisation, and to spend money in the most effective ways. The project has analysed a number of engineering components alongside the RNLI’s supply chain data which has led to the development of two educational case studies which promote the benefits AM could offer the RNLI and the wider industry. The two specific components investigated were the ‘Mast Latch Handle’ and the ‘Sea Water Inlet Strainer’. The ‘Mast Latch Handle’ is an aluminium part manufactured traditionally from a stock piece of material. The ‘Sea Water Inlet Strainer’ is a component used on a variety of different lifeboat class’s, to stop debris from entering the engine cooling system. It is currently fabricated from a wrapped stainless steel sheet and two stainless steel flanges either end. Both case studies detail the redesign of the parts for AM providing equivalent or better performance, reduced weight, reduced cost and significantly shorter lead times. The project successfully demonstrated the advantages that additive manufacturing could have on the RNLI and their values. With the use of additive manufacturing, the RNLI now understand that they could achieve consolidated part reductions, reduced lead times, less material waste, weight reductions and reduced transportation. Using AM would lead to business and environmental advantages for the organisation. The project has resulted in AM being implemented as a focus into the RNLI engineering team time plan. Additive manufacturing is now at the forefront when new and existing engineering designs are conceived, and a manufacturing process is selected. Further work is required such as upskilling RNLI engineering teams on designing for AM, and on the execution of the AM process, followed by the implementation of an AM facility on site in RNLI Poole Headquarters.