In February, the National Institute of Standards and Technology released guidelines for secure software development, meeting a deadline established by President Biden’s May Executive Order on Improving the Nation’s Cybersecurity.
The new guidelines, embodied in NIST publication SP 800-218, outline the obligations that producers of commercial off-the-shelf (COTS) and government off-the-shelf (GOTS) software have if they are licensing software or services to federal agencies.
[ Get a free SBOM and full supply chain risk analysis report ]
The guidance includes things like following secure software development practices; collecting, maintaining, and sharing provenance data for all software components; and tracking software dependencies. Software producers are also urged to check their code for backdoors and other malicious content - a clear reference to the now infamous compromise of SolarWinds, which affected a number of sensitive Federal agencies. (For more on SolarWinds, read our blog post: "Sunburst: the next level of stealth")
What does NIST’s new Secure Software Development Framework (SSDF) mean for software firms and their customers? And how can companies begin to wrap their arms around the new guidelines from Uncle Sam?
To get answers to those questions and others, we sat down with Tomislav Peričin, the Chief Software Architect at ReversingLabs for a chat. In this video chat, recorded just after the NIST guidance was published, Tomislav and host Paul Roberts dig into the details of the new NIST framework. They also talk about emerging federal requirements for software producers to maintain so-called Software Bills of Materials (SBOMs) that provide an ingredient list for software and services used in federal agencies.
Check out their conversation below!
Get up to speed on key trends and learn expert insights with The State of Software Supply Chain Security 2024. Plus: Explore RL Spectra Assure for software supply chain security.
Keep learning
- See special and Webinar: CSF 2.0 and C-SCRM for Software Risk Management
- Join the Webinar: Unraveling XZ: A Software Supply Chain Under Siege
- Special Report: The State of Supply Chain Security 2024
- Get Gartner's guidance on managing software supply chain risk
- Learn why/see buyer's guide: Upgrade your AppSec tools for the SSCS era