Software Supply Chain Aspects in Infrastructure as Code Lior Kaplan, Checkmarx

### Overview In this talk, Lior Kaplan, Open Source Officer at Checkmarx and project lead for KICS (Keep Infrastructure as Code Secure), explores how supply chain security challenges in traditional software apply directly to Infrastructure as Code (IaC) and containerization. Kaplan argues that while moving everything to code provides scalability, efficiency, and repeatability, it also inherits the vulnerabilities of the software supply chain, such as dependency confusion, typosquatting, untrusted third-party artifacts, and visibility blind spots.

### Key Topics - **Software Supply Chain Threats**: Recent trends show an increase in intentional attacks, including fake GitHub clones, typosquatting campaigns in PyPI and npm, phishing against package maintainers, and malicious packages pushed via social media trends. - **Everything as Code and Reuse**: Infrastructure as Code tools (Dockerfiles with `FROM`, Terraform templates, Helm charts, AWS CloudFormation includes) encourage component reuse, creating extensive external dependencies. - **Registry Confusion and Typosquatting**: Searching for popular components like MinIO on registries (such as Artifact Hub or container registries) yields multiple confusing results, where official images may lack distinguishing marks or not appear at the top, leaving users susceptible to malicious or outdated lookalikes. - **Hidden Supply Chains in Containers**: Using the official WordPress container as a case study, Kaplan demonstrates a dependency chain going from WordPress to PHP (built from source) to Debian Buster Slim, and ultimately to an extracted root tarball from an external user URL, illustrating how hard it is to trace artifact provenance. - **Limits of Container Scanners and Signatures**: Scanners rely heavily on OS package metadata, which can be missing in distroless containers or when binaries are installed directly. Similarly, tools like Cosign prove who signed an image but cannot guarantee the artifact itself is safe or built from clean sources, as highlighted by incidents like Fishpig where build infrastructure was compromised.

### Technical Details - **Metadata and Distroless Trade-offs**: Container vulnerability scanners typically inspect package manager databases (dpkg, npm, pip) and MD5 checksums. Distroless containers reduce attack surfaces by stripping OS utilities, but also remove the metadata needed by scanners to identify installed packages and verify origins. - **Reproducible Builds**: Open-source reproducibility—pioneered in Linux distributions like Debian—is highlighted as the strongest method to verify that built binaries match their published source code, though container ecosystems currently lack widespread reproducible verification. - **Static IaC Security with KICS**: Kaplan advocates using KICS, an open-source tool utilizing Open Policy Agent (OPA) rules, to scan Dockerfiles, Helm charts, and other IaC templates early in development to flag insecure patterns (such as downloading arbitrary tarballs inside a container rather than cloning tracked Git commits).

### Takeaways Containers and infrastructure code are fundamentally software and suffer from the same software supply chain vulnerabilities. Organizations must avoid blindly trusting signatures or registry rankings, prefer Git repositories with commit hashes over opaque tarball downloads, verify artifact origins through reproducible builds, and use IaC security scanners like KICS early across development pipelines.