Sotware Supply Chain

Federal Guidelines Have Changed. Has Your Software Security?

With threat actors targeting open-source artifacts, software development systems, and DevOps pipelines, it’s impossible to exaggerate just how risky the software supply chain is today. With so many moving components to the software lifecycle, threats can enter at multiple phases. Even if you apply the best security practices in developing your own code, applications, and infrastructure, you still depend on third-party components completely outside of your control.

The Cybersecurity Executive Order (EO) 14028 addresses cyber risks in the software supply chain and sets the stage to establish baseline security standards for developing software—especially critical software—that is sold to the federal government. Key provisions include requiring developers to have greater visibility into their software and making security data publicly available. But that’s just the start.

The ever-growing complexity of software, infrastructure, and dependencies combined with the growing number of pervasive and increasingly malicious attacks targeting the supply chain make defending against such attacks not only a priority but a necessity. Merlin offers innovative, disruptive solutions engineered to strengthen agencies’ ability to prevent, detect, mitigate, and respond to supply chain attacks.