In 2022, the U.S. Bureau of Labor Statistics estimated that over 2 million people in the U.S. worked as software and web developers, programmers, and testers (category 15-1250, formerly 15-1130).1 The following is a graph charting the population growth in the category over a decade of available statistics. The bars show the absolute growth while the trend line represents the year-over-year (YoY) growth percentages.

Figure 1.1: Year-over-year growth percentage of developers in the US

Worldwide, the industry is expected to grow to over 28 million software developers in 2024.2 Thanks to complexity and specialization, a few of those developers work alone or create all the components of their software from scratch. They use software to build software, collaborate, deliver software, and provide backend services for their software, and monitor it all in production. All the software and services used by developers to create software are collectively called the software supply chain (SSC) and it has become more and more popular as an attack vector.

The growth in software supply chain attacks is not just anecdotal—it’s being quantified. The non-profit Identity Theft Resource Center reported that between 2018 and 2023, supply chain attacks rose 2,600% to represent over 15% of reported identity data theft in 2023.3 A year earlier, Help Net Security noted that supply chain attacks had outpaced malware as a source of data breaches.4 The European Union Agency for Cybersecurity, in their Foresight Cybersecurity Threats for 2030 report, listed supply chain compromise of software dependencies as their #1 threat by the end of the decade, based on both likelihood and impact, scoring 44% higher than ransomware.

Regulatory pressures to address software supply chain security are increasing as well. In US President Joe Biden’s 2021 Executive Order on Improving the Nation’s Cybersecurity, over 25% of the document focused on improvements in software supply chain security, including requiring both internal federal agency developers and external software vendors to provide more transparency about their processes and the provenance of their software.

Developing securely isn’t simply about avoiding issues in the future. It is about taking the right steps, the right precautions, and being able to document that for stakeholders, customers, and regulators. For example, the U.S. Securities and Exchange Commission requires all annual reports for publicly traded companies to include a section on how the company is managing cyber risk for fiscal years starting after December 15, 2023.5

Security awareness

The security culture of an organization is foundational to its ability to protect information, data, and employee and customer privacy. Companies are moving beyond reactive, episodic approaches to security and recognizing that effective enterprise-wide security requires a strategic, long-term approach, focusing more on reliable mechanisms, communication, and culture than lectures from IT and an ongoing stream of new policy mandates.

During the pandemic, industries and organizations saw their security cultures stagnate or decline. As many organizations transitioned to a work-from-home model, new security issues and concerns emerged, while the diaspora of knowledge workers made communication and education more challenging.

Threats such as ransomware can escape notice and do damage for months before detection, even in top-performing organizations. Ongoing awareness, understanding, and appropriate actions are required to ensure organizations’ data is safe and that employee and customer data is not compromised.

Security culture is a critical, must-have asset in the security toolbox. By assessing employees’ security awareness, behaviors, and culture, organizations can adapt their policies and training programs to the constantly changing threat landscape.

Regulatory compliance and legal considerations

While this will be addressed in greater detail in Chapter 7, Security Compliance and Certification, you should be aware that new legislation and regulations are being put in place at state, federal, and agency levels on multiple continents. Whether you make or simply use software, there's increasing pressure to ensure that not only the application but the information it processes is also secure.

These laws and regulations around reporting and compliance come on top of legal liability and reputational damage both for the institutions and their officers. The U.S. Securities and Exchange Commission has specifically gone after the CISO of one hacked company as part of its enforcement action. This will be discussed in detail later in the chapter. That comes on top of the company losing 64% of its market capitalization since the incident.

These laws and regulations are designed to prevent serious incidents with national or global impacts by ensuring that companies have effective strategies and practices in place.

Whether your company handles data or provides crucial services in banking and finance, transportation, utilities, or healthcare, you will face more scrutiny and responsibility from regulators and law enforcement. By adopting strong security measures, you can meet these challenges and ensure compliance, keeping your organization and its stakeholders safe.

Who are the threat actors?

Behind every cyber threat, there’s a threat actor: a person or group of people causing intentional harm by exploiting vulnerabilities in the cyber sphere. They are usually the perpetrators behind cyberattacks, and are often categorized by a variety of factors, including motive, type of attack, and targeted sector. As the frequency and sophistication of cyber threats continue to grow, so will the number of threat actors behind them.

Today, the cyber threat environment is arguably more dynamic than ever before, and threat actors are becoming more sophisticated. Understanding threat actors and their motives can help organizations better protect themselves from the damage these actors cause as they exploit vulnerabilities, compromise user identities with elevated privileges, evade security controls, damage or delete data, or manipulate sensitive information.

One of the larger developments in the security landscape over the years has been the rise of the advanced persistent threat (APT).

What is an APT?

According to the U.S. National Institute of Standards and Technology, an APT can be defined as follows:

“An adversary with sophisticated levels of expertise and significant resources, allowing it, through the use of multiple different attack vectors (e.g., cyber, physical, and deception), to generate opportunities to achieve its objectives, which are typically to establish and extend its presence within the information technology infrastructure of organizations for purposes of continually exfiltrating information and/or to undermine or impede critical aspects of a mission, program, or organization, or place itself in a position to do so in the future; moreover, the advanced persistent threat pursues its objectives repeatedly over an extended period of time, adapting to a defender’s efforts to resist it, and with determination to maintain the level of interaction needed to execute its objectives.”

While this is the textbook definition, to put it more simply, APT stands for:

1. Advanced: APTs have resources, skills, and organization. Contrary to the stereotypical image depicted in popular media, they are professionals, often trained by state agencies, and sometimes still employed (or sanctioned) by them.
2. Persistent: APT actors typically set up camps, take measures to avoid detection, create backdoors to get back in if you detect and close their main entry point, and move laterally throughout compromised systems to find more things to steal or damage and more connected systems to infiltrate.
3. Threat: Needs no explanation.

APTs include organized professionals that pull off data thefts, cryptocurrency thefts, ransomware, corporate espionage, state-sponsored espionage, and even terrorism. In many cases, it’s more than one motive and it’s profitable. As this book details hacks, it will discuss APT groups and their methods in more detail.

Chainalysis, in their 2024 Crypto Crime Report, claimed that ransomware became a billion-dollar business in 2023.6 This was an estimate of ransomware payments, exclusive of the damage done. Due to that damage, the cost of ransomware was even higher. For example, while the ransomware attack on MGM Resorts in 2023 did not result in a payment to the group that successfully infiltrated MGM’s systems, it’s estimated that the clean-up costs were around $100 million.

While some of the access they gain is through deception and social engineering, APTs have increasingly used supply chain attacks to gain footholds or seed vulnerabilities in corporate and even government systems. In this regard, the SolarWinds case serves as a textbook example.

The SolarWinds supply chain attack is an example of the ability to use a successful incursion into a supply chain node to seed vulnerabilities well beyond the compromised system.

The company describes its Orion software as a “powerful, scalable infrastructure monitoring and management platform designed to simplify IT administration for on-premises, hybrid, and software as a service (SaaS) environments.”

In 2020, customers using that software were notified of an update offering the usual fare of bug fixes and feature updates. The update had been compromised by an APT believed to be affiliated with the Russian intelligence service (the SVR), and infected with malware.

In later interviews, the CEO estimated that 18,000 customers downloaded the adulterated update.7 This was just a trick to get the customers to download a bad update from a website with some deceptive variation on the company name that might escape cursory inspection by a harried office worker. The APT had compromised SolarWinds’ systems and inserted the malware in an official update package without being noticed.

In an attack staged over the course of seven months, the hackers obtained access to the SolarWinds network, tested that access to ensure they could execute their hack, injected malicious code into the software, and caused Orion customers to start receiving updates containing the malicious software.

Notable entities such as Microsoft, the U.S. Postal Service, the U.S. Department of Energy, and the U.S. Department of Homeland Security received and were impacted by the malicious code. Because of the privileges the software needed to perform its “infrastructure monitoring and management” duties, the hackers received backdoor access to not only the data and networks of the companies using Orion but many of their customers too.

It’s estimated that up to 30,000 entities were potentially vulnerable, though the actual exploitation of the vulnerability is believed to be significantly lower. According to security agency FireEye, even after being infected with the compromised update, “these compromises are not self-propagating; each of the attacks requires meticulous planning and manual interaction."8

As reinforcement of the accusation against Russia, the Biden administration tied its April 2021 package of sanctions against Russia, at least in part, to the SolarWinds supply chain attack.

Besides the immense reputational damage done to SolarWinds, the Securities and Exchange Commission (SEC) filed a lawsuit in October 2023 charging SolarWinds and their CISO with defrauding investors and failing to maintain adequate internal controls. Between the disclosure of the hack in 2020 and the filing of the SEC action in 2023, their stock fell by nearly 64% and the SEC action seeks to bar their CISO from being an officer or director of a public corporation for the rest of his life.

Not every hack is a hack

Along with real stories of hacks, the internet is littered with sensationalized stories of hacks.

For example, in 2021, many news outlets reported that the city of Oldsmar, Florida, had been hacked to poison its water system, which served approximately 15,000 people.9 In this case, systems that add lye to the water supply to reduce acidity in the water were altered to increase the amount by approximately 11,000 percent. The alteration was caught in time and reversed by an alert employee who prevented it from causing actual harm.

No further details were released on who might be responsible or how they gained access to Oldsmar’s systems as the FBI and the Pinellas County Sheriff conducted their investigation. And that was the story until 2023. During a cybersecurity panel at a meeting of the American Society for Public Administration, the former city manager admitted that the FBI’s conclusion, after a four-month investigation, was that it wasn’t a hack. It was an employee error.10

While some of the hacks discussed in this book will be old enough at the time of writing to have been thoroughly covered and vetted, some more recent stories may appear simply because they provide the best illustration of a concept in the opinion of the authors. These facts have been vetted as thoroughly as possible before publication.

The proliferation of cloud services has expanded the attack surface for cybercriminals. According to IBM’s 2023 Cost of a Data Breach, 82% of breaches involved data stored in the cloud.11

One of those cloud storage services is well known to developers: GitHub. GitHub neither created nor owns Git, a popular tool for version control, source code management, and code collaboration. It is, however, the most popular Git service provider in the world.

In 2017, two French data scientists notes that their contemporaries often included plain-text credentials in the scripts and apps they wrote and they wanted to see how common it was. Since GitHub has one of the largest collections of publicly available source code in the world, they decided to scan it for credentials.

As they refined their algorithms to catch more and weed out false positives, the numbers grew more shocking. In their 2024 State of Secrets Sprawl report, GitGuardian found over 12.8 million new instances of secrets committed to GitHub repositories in 2023, an increase of over 28% from the prior year.

When the French scientists first discovered this in 2017, they started letting people know that their passwords, API keys, and other secret credentials were sitting in public view on GitHub and soon signed their first customer for a tool to detect and prevent secrets sprawl. That was how GitGuardian came into being and found its first client.

Since then, GitGuardian has built hundreds of specific detectors, provides free services to smaller developer teams, and helps clients ranging from SMBs to Fortune 500 companies find, remove, remediate, and prevent exposed credentials in their source code.

GitGuardian has expanded and improved its offering and services. It now provides the following:

• Both cloud and on-premises solutions for detecting and remediating leaked secrets
• The ability to scan multiple types of software artifacts and developer tools for secret leaks
• Honeypot credentials called honeytokens to help detect when/where hackers find your secrets
• Infra-as-code scanning and software composition analysis (SCA), a crucial part of securing your software supply chain and documenting it

In this chapter, we’ve discussed the threat landscape, threat actors, and why your security is important to you, your customers, and governments around the world. We’ve shown how one company’s security incident became a threat to national security and how the government responded by punishing both the country responsible for the hack and the hacked company for its allegedly inadequate and deceptive response.

Jeff Bezos is famously credited with the following quote: “Good intentions don’t work, mechanisms do.”12 Alternatively “mechanisms > intentions” (mechanisms are greater than intentions) is used within Amazon’s culture.

This is intended to mean that even the best intentions will not guarantee the best results. Corners get cut and steps get skipped by the best of us, not maliciously, but out of forgetfulness, distraction, or logic that seemed sound at the time. By creating mechanisms as a forcing function to keep those corners un-cut and those steps un-skipped, those intentions get realized more fully and more often.

As this book progresses and the different points at which the software supply chain is attacked are examined, you will explore strategies for implementing training, tools, and mechanisms across the SDLC to fortify your organization’s defenses and develop secure applications.