Ask HN: How does your org deal with supply chain risk?
I can share 2 examples that I encountered.<p>The first in the technical domain: a pentest finding in a previous project. We were using pip with requirements.txt files. Since this doesn’t include Python package hashes a compromised mirror or DNS poisoning could lead to malicious code being executed in our build pipeline. Recommendation was to move to pyenv and a Pipfile.lock because it does support hashes and also provides deterministic dependencies.<p>The 2nd is a fascinating example in the administrative domain that I stumbled upon while looking for something else. It’s NASA Glenn Research Center trying to perform Country of Origin Verification of OSS software. Apparently the Octave [0], Cygwin [1] and GIMP [2] mailing lists were fortunate enough to be included in this process. Given the timespan between the posts this seems to be taken rather seriously. I also found the likely reason in [3]: since 2019 they have a new supply chain risk management proces. Slide 10 gives some additional background.<p>Can you share how supply chain risks are mitigated in your organization by either technical and&#x2F;or administrative controls?<p>[0] https:&#x2F;&#x2F;octave.1599824.n4.nabble.com&#x2F;Country-of-Origin-Verification-3144-td4696407.html<p>[1] http:&#x2F;&#x2F;cygwin.1069669.n5.nabble.com&#x2F;Country-Of-Origin-Verification-8944-td152055.html<p>[2] https:&#x2F;&#x2F;www.talkend.net&#x2F;post&#x2F;75432.html<p>[3] https:&#x2F;&#x2F;csrc.nist.gov&#x2F;CSRC&#x2F;media&#x2F;Projects&#x2F;cyber-supply-chain-risk-management&#x2F;documents&#x2F;SSCA&#x2F;Spring_2019&#x2F;9MayAM1.2_NASA_SSCA_May_9th.pdf