Software Security in Supply Chains: Vulnerability Management

Vulnerabilities are discovered in a variety of sources. Developers of software may find security bugs in already-deployed code. Security researchers and penetration testers may find vulnerabilities by scanning or manually testing software and accessible systems. Effectively identifying, triaging, remediating, and reporting vulnerabilities is a central pillar of the EO. In its discussion of Zero Trust architecture, the EO recognizes that the discovery of vulnerabilities is inevitable, and federal agencies’ strategies should focus on how to manage those vulnerabilities efficiently and comprehensively.

Agencies should adhere to NIST’s existing Vulnerability Disclosure Program guidance in Draft NIST SP 800-216, Recommendations for Federal Vulnerability Disclosure Guidelines, which addresses reporting, coordinating, publishing, and receiving information about security vulnerabilities. They can also impose a range of recommended activities and capabilities from suppliers to enable more comprehensive and timely management of vulnerabilities.

Foundational Capabilities

• Demonstrate the adoption of SSDF V1.1 in the development of software (e.g., effective change control, automation, robust CI/CD, and DevSecOps practices to mitigate and report common vulnerabilities in accordance with RV practices).
• Establish a formal, publicly available means by which the public can notify the supplier of uncovered vulnerabilities.[1]
• Adhere to ISO/IEC 30111, Information technology — Security techniques — Vulnerability handling processes and/or ISO/IEC 29147, Information technology — Security techniques — Vulnerability disclosure, as appropriate.

Sustaining Capabilities

• Adhere to a coordinated vulnerability disclosure (CVD) practice to ensure that federal departments and agencies are able to remediate vulnerabilities in a timely manner.[2]
• Integrate SBOMs, vulnerability databases, and reporting mechanisms to ensure that federal departments and agencies rapidly receive notification of recently released vulnerabilities.

Enhancing Capabilities

• Engage suppliers that staff defined product security incident response teams (PSIRT) and/or internal research teams dedicated to the identification, triage, and remediation of vulnerabilities across the supplier’s product/service suite in support of SSDF V1.1 Prepare the Organization (PO) and RV practices.[3]
• Buy from suppliers that utilize a formal bug bounty program to incentivize the discovery and proactive remediation of vulnerabilities before adversaries are able to utilize them, where feasible and legally appropriate.

Content:

• Introduction

• Guidance, Purpose, Scope, and Audience

• EO-Critical Software and Security Measures for EO-Critical Software

• Software Cybersecurity for Producers and Users

  • Attesting to Conformity with Secure Software Development Practices

• Software Verification

• Evolving Standards, Tools, and Recommended Practices

  • Software Bill of Materials (SBOM)

  • Enhanced Vendor Risk Assessments

  • Open Source Software Controls

  • Vulnerability Management

• Additional Existing Industry Standards, Tools, and Recommended Practices

• Frequently Asked Questions (FAQs)