SoK: Analysis of Software Supply Chain Security by Establishing Secure Design Properties

Abstract

This paper systematizes knowledge about secure software supply chain patterns. It identifies four stages of a software supply chain attack and proposes three security properties crucial for a secured supply chain: transparency, validity, and separation. The paper describes current security approaches and maps them to the proposed security properties, including research ideas and case studies of supply chains in practice. It discusses the strengths and weaknesses of current approaches relative to known attacks and details the various security frameworks put out to ensure the security of the software supply chain. Finally, the paper highlights potential gaps in actor and operation-centered supply chain security techniques. CCS CONCEPTS• Software and its engineering → Design patterns; • Security and privacy → Software security engineering; • General and reference → Surveys and overviews.

An Empirical Study of Pre-Trained Model Reuse in the Hugging Face Deep Learning Model Registry

“…Reusability and trustworthiness problems in software package registries impact the relevant ecosystems [10][11][12]. Much is known about the practices and challenges of reusing traditional software packages [13][14][15], but how this knowledge transfers to the reuse of PTM packages has not been investigated. Existing software engineering knowledge describes how large companies manage private models [16,17].…”

Arquitetura para escalonamento oportunístico na nuvem com qualidade de serviço

“…Aplicac ¸ões que lidam com dados sensíveis, por exemplo, precisam da garantia que seus dados serão protegidos. Ameac ¸as cada vez mais comuns à cadeias de suprimento de software (com crescimento de até 650% cumulativos até 2021 [Okafor et al 2022]), como o ataque à SolarWinds em 2020 [Peisert et al 2021], enfatizam essa preocupac ¸ão. Medidas de seguranc ¸a não são cobertas por esse artigo, mas guias fortes como SLSA da Google e Secure Software Factory da CNCF podem ser seguidos para fortalecer a seguranc ¸a de aplicac ¸ões sensíveis na nuvem, e potencialmente permitir o uso de aplicac ¸ões assim em um modelo oportunista.…”