Scaling Software Supply Chain Source Security in Large Enterprises

Rao Lakkakula, Senior Director of Security Engineering at JP Morgan Chase, presents a comprehensive overview of software supply chain security in enterprises. He begins by categorizing the evolution of supply chain attacks from traditional vulnerabilities (Heartbleed, Shellshock) to infrastructure-level compromises (SolarWinds) to intentionally malicious packages designed to infiltrate systems upon installation. The scale and impact differ significantly from traditional incidents: supply chain breaches affect hundreds of thousands of systems globally and defeat traditional perimeter defenses because malicious software is deeply embedded in dependencies and often runs with elevated privileges.

Lakkakula outlines the complexity of enterprise software supply chains, which encompass internal applications, open source dependencies, vendor/closed-source software, SaaS platforms, and hardware supply chains—each introducing multiple attack vectors. He proposes five core strategies for securing these supply chains: (1) Understand and catalog all software processes in the enterprise, including shadow IT and various build pipelines; (2) Monitor ingestion points where software enters, validating source reputation and component security hygiene; (3) Build a comprehensive, queryable inventory of all assets (applications, dependencies, hardware) and their deployment locations; (4) Secure SDLC processes including source repositories, build systems, and artifact storage; (5) Implement continuous automated monitoring for new vulnerabilities. He emphasizes defense in depth rather than single-vendor solutions.

The discussion includes Software Bill of Materials (SBOM)—structured documents listing software components and dependencies—and Vulnerability Exploitability Exchange (VEX), which maps whether specific CVEs actually impact a given piece of software. Operationalizing SBOMs involves standardizing formats (SPDX, CycloneDX, SWID), determining storage strategies, and verifying authenticity and integrity. Lakkakula references government guidance (White House Executive Order, NIST SSDF framework) and industry initiatives (OpenSSF with SLSA, FS-ISAC working groups, CNCF). He stresses that no organization has implemented all measures perfectly and advocates for industry collaboration through working groups and community feedback. The candy store analogy illustrates enterprise reality: like a store carrying candy from worldwide sources, some out of production, software supply chains include components from unknown origins, some no longer maintained, creating complexity comparable to managing thousands of inventory items.