AI, the Software Supply Chain, and Other (Not So) Puzzling Pieces

AI, the Software Supply Chain, and Other (Not So) Puzzling Pieces

Speakers: Jacob, Deputy Chief Security Officer, GitHub

Conference: RSAC 2024

YouTube: https://www.youtube.com/watch?v=dgYnDX7YU6E

Overview

In this insightful talk from RSAC 2024, Jacob, Deputy Chief Security Officer at GitHub, draws a compelling parallel between personal health and the often-overwhelming landscape of software supply chain security. Just as individuals can get lost in the minutiae of optimizing every health metric, organizations frequently become fixated on the latest security tools and features, neglecting fundamental security hygiene. Jacob argues that while advanced optimizations have their place, a robust security posture is built upon foundational principles, which he distills into three core pillars: software security and secrets, platform and developer security, and build systems and dependencies.

The presentation underscores the immense scale and complexity of securing the modern software supply chain, particularly in an era where Artificial Intelligence (AI) is rapidly transforming development workflows. With GitHub seeing billions of contributions and millions of build minutes annually, the challenge of securing every component and process is monumental. Jacob not only highlights the pervasive impact of AI on development, with tools like GitHub Copilot generating a significant portion of new code, but also addresses its dual role as both an enabler for threat actors and a powerful ally for defenders in combating sophisticated attacks.

This talk is crucial for anyone involved in software development, security, or organizational leadership grappling with the challenges of securing their digital assets. It provides a pragmatic framework for prioritizing efforts, emphasizing that addressing the basics—like robust secret management, strong developer authentication, and verifiable build provenance—yields the most significant security dividends. Furthermore, it offers a forward-looking perspective on how AI, when thoughtfully integrated, can enhance security capabilities across the entire software development lifecycle, rather than being viewed solely as an additional threat vector.

Background

▶ Watch: Introduction and health/wellness analogy (0:00)

The concept of the software supply chain has gained significant prominence as organizations increasingly rely on open-source components, third-party libraries, and complex build environments. Jacob defines the software supply chain broadly, encompassing not just the first-party code developed in-house and its dependencies (like Python packages, Ruby gems, NPM packages), but also foundational components such as operating systems and hardware, along with the entire suite of tools used in the Software Development Life Cycle (SDLC)—CI/CD platforms, developer environments, ticketing systems, and even the security of developer workstations. This holistic view is critical because a compromise in any one of these elements can introduce vulnerabilities that propagate throughout the entire system.

Jacob uses the analogy of manufacturing an automobile to illustrate the depth of this problem. Understanding what parts go into a car is akin to a Software Bill of Materials (SBOM), which lists the ingredients of a software product. However, the analogy extends further: knowing the security of the manufacturing facility (platform security), who holds the keys (secret management), and the integrity of the design and build processes (provenance) are equally vital. The current landscape is fraught with complexity, with hundreds of tools, standards, and recommendations available, making it challenging for organizations to identify where to begin. This often leads to a focus on niche optimizations (the "probiotics vs. prebiotics" dilemma) rather than addressing fundamental security hygiene.

The scale of the problem is staggering, as evidenced by GitHub's operational metrics. In 2023 alone, GitHub recorded 4.5 billion total contributions (142 per second), 730 million build minutes via GitHub Actions, and 86,000 NPM downloads per second. This massive scale translates directly into security challenges: GitHub observed 10 million leaked secrets and 7 million unresolved code scanning dependencies in 2023. Furthermore, 2.3 million organizations had data accessed by OAuth applications, highlighting the pervasive risk of third-party integrations. These figures underscore that progress in software supply chain security cannot be achieved through a single tool or standard but requires a concerted, multi-faceted approach across the industry.

Key Findings

▶ Watch: The three fundamental pillars of software supply chain security (2:40)

Jacob's talk crystallizes several key findings regarding the state and future of software supply chain security:

1. Fundamentals Over Optimization: The most impactful security gains come from addressing foundational elements rather than hyper-optimizing niche areas. He outlines three core pillars: Software Security and Secrets, Platform and Developer Security, and Build Systems and Dependencies. Neglecting these basics leaves significant attack surface open, regardless of advanced tooling.
2. AI's Dual Role: AI is an undeniable force in modern development, with GitHub Copilot generating a substantial and growing percentage of code. This presents both a new attack surface (threat actors using AI for abuse campaigns, potential for AI-introduced vulnerabilities) and a powerful defensive tool (AI-assisted code security, abuse detection). Embracing AI, rather than avoiding it, is essential for future supply chain security.
3. The Criticality of Provenance and Attestations: Beyond just knowing what's in a software package (SBOM), it's crucial to know where it came from and how it was built. Provenance, defined as a non-falsifiable link back to the artifact's source code and build instructions, coupled with attestations (cryptographically assured statements of fact about a build), provides the necessary confidence in the integrity of software components. This capability, demonstrated with NPM package provenance and Sigstore, is becoming a standard for verifiable software integrity.
4. Developer Experience is Key: Security measures must integrate seamlessly into the developer workflow to be effective. Tools like GitHub Copilot and GitHub Advanced Security, which provide in-editor or in-pull-request vulnerability detection and AI-suggested fixes, empower developers to remediate issues without breaking their flow. Similarly, Push Protection for secrets prevents issues before they ever land in a repository, saving significant remediation effort.
5. Multi-Factor Authentication and Passkeys: Account takeovers remain a primary vector for breaches. Mandating Two-Factor Authentication (2FA) and advocating for Passkeys significantly hardens developer and platform security by mitigating common attacks like social engineering, credential theft, and password leaks.

Technical Deep Dive

▶ Watch: Defining the software supply chain comprehensively (3:30)

Jacob structures the technical deep dive around his three fundamental pillars, demonstrating practical implementations and highlighting how AI is interwoven into these solutions.

Pillar 1: Software Security and Secrets

This pillar focuses on securing the code itself and preventing the exposure of sensitive credentials. GitHub's internal observations underscore the scale of the problem, with 10 million leaked secrets and 7 million unresolved code scanning dependencies identified in 2023.

• Code Security Scanning: Tools like GitHub Advanced Security perform Static Application Security Testing (SAST) to detect vulnerabilities in code. Jacob demonstrates how AI, specifically GitHub Copilot, is integrated into this process. When a developer copies potentially vulnerable code (e.g., an SQL injection vulnerability in a Django application) into VS Code, Copilot can proactively identify the flaw, explain its nature, and offer a native, idiomatic fix for the framework being used (e.g., Django's ORM for parameterized queries). This in-editor feedback loop is critical for "shifting left" security.
• AI-Assisted Remediation in Pull Requests: Beyond the editor, GitHub Advanced Security extends this capability to pull requests. When a PR containing a known vulnerability is opened, the system not only flags the issue but, powered by Copilot, can automatically suggest a fix directly within the PR interface. This allows developers to review, accept, or modify the proposed solution without leaving their workflow, significantly reducing the time and effort required for remediation.
• Secret Push Protection: This is a crucial preventative measure. Jacob demonstrates a scenario where a developer attempts to commit a Cosmos DB secret directly into the code. Before the commit even reaches the GitHub repository, Push Protection intercepts it, rejects the push, and provides the developer with immediate feedback on why it was blocked, along with options for remediation. This capability prevents secrets from ever being exposed in the repository, averting potentially hours of recovery work (like rotating credentials and scrubbing history) and mitigating the risk of a threat actor pivoting from a leaked secret.

Pillar 2: Platform and Developer Security

This pillar addresses the security of the platforms and accounts developers use.

• Strong Developer Authentication: Jacob emphasizes that Two-Factor Authentication (2FA) is "table stakes." GitHub's controversial but successful move to require 2FA for all code contributors resulted in a 95% opt-in rate and a one-third reduction in 2FA support tickets, demonstrating its effectiveness.
• Passkeys: Representing a significant leap forward, Passkeys address two major gaps in traditional password-based authentication: lost passwords and phishing. By leveraging cryptographic keys tied to devices, Passkeys provide a phishing-resistant, passwordless experience. Jacob cites the FIDO Alliance's statistic that over 80% of data breaches trace back to passwords, highlighting the transformative potential of Passkeys, with GitHub already seeing 1.4 million Passkeys registered.
• Third-Party Integrations: These are distinct from software dependencies and include tools like CI/CD platforms, metrics integrations, and OAuth applications. While they aid in the SDLC, they can pose significant risks. Jacob stresses the need to thoroughly vet these integrations, asking: "If this app or system gets owned, what's the possible impact to us?" The statistic of 2.3 million orgs with data accessed by OAuth applications underscores the widespread exposure. Organizations must consider the access privileges granted to these integrations and their potential as pivot points for attackers.

Pillar 3: Build Systems and Dependencies

This pillar focuses on securing the components that make up the software and the integrity of the build process.

• Automatic Dependency Updates: Dependabot is highlighted as a key tool for keeping software dependencies (NPM, Python, Ruby packages) up to date. It automatically opens pull requests for developers to triage and accept, significantly reducing the attack surface by ensuring known vulnerabilities in older versions are patched promptly. This is often enforced as part of an organization's SDLC.
• SBOMs and Provenance: While Software Bill of Materials (SBOMs) are essential for knowing what's in a software package, Jacob argues they are insufficient without provenance. Provenance provides a "non-falsifiable link back to the artifact source code and build instructions." Without confidence in where and how a component was built, the value of an SBOM diminishes.
• NPM Package Provenance with Sigstore and GitHub Actions: Jacob demonstrates GitHub's new artifact attestations capability, developed in partnership with Sigstore.
• Attestations vs. Signatures: He clarifies that while software signing is important, attestations are cryptographically assured statements of fact (e.g., by GitHub Actions) that create an unforgeable paper trail linking a build artifact back to the workflow that produced it.
• Seamless Workflow Integration: The demo shows a GitHub Actions workflow that, when triggered, uses an Actions OIDC token to communicate with Sigstore, obtaining a signing certificate. This process generates an attestation that is then stored in a durable location in the repository (the new attestation view on GitHub). This makes signing and attestation generation a seamless part of the CI/CD pipeline.
• Verification with GitHub CLI: Using the gh command-line tool, a user can download a package and then verify its integrity and provenance. The CLI checks the code signing certificate, cryptographically verifies it, and confirms that hashes match, ensuring the package hasn't been tampered with.
• Detailed Attestation Information: The verification process can also display detailed information from the attestation, including the issuer (GitHub Actions), the source repository URI, the build signer URI, and crucially, the run invocation URI, which links directly back to the build logs of the specific workflow that produced the package. This level of linkage is invaluable for triage and forensics in the event of a supply chain incident.
• Policy Enforcement with Open Policy Agent (OPA): Jacob illustrates how these attestations can be used to enforce policies in production environments. Using a policy language like Rego for Open Policy Agent, an organization can dictate that only packages originating from specific repositories, workflows, or even immutable identifiers (to prevent repo jacking) are allowed to be deployed. This provides a scalable mechanism for ensuring that only trusted, verified software makes it into production. This capability works for both public and private source code on GitHub.com.

Demo / Proof of Concept

▶ Watch: The massive scale of software supply chain challenges (GitHub data) (5:50)

Jacob presented a multi-part demonstration showcasing practical applications of GitHub's security features, particularly in the context of AI and build provenance.

1. AI-Assisted Vulnerability Remediation (In-Editor):

• Scenario: A developer is working on a Django conference management application in VS Code. They copy and paste a snippet of code from an online form into the agenda.py file, intending to display conference talks. This code, unbeknownst to them, contains an SQL injection vulnerability.
• GitHub Copilot Intervention: Before committing the code, the developer highlights the suspicious code and asks GitHub Copilot (integrated into VS Code) if there are any security flaws. Copilot immediately identifies the SQL injection, explains its nature, points to the exact line of code, and provides a corrected code snippet that uses Django's native ORM for parameterized queries, effectively preventing the vulnerability. This highlights the power of "shift-left" security with AI assistance.

1. AI-Assisted Vulnerability Remediation (Pull Request):

• Scenario: The developer proceeds to commit the vulnerable code and opens a pull request.
• GitHub Advanced Security & Copilot Integration: On the pull request page, GitHub Code Scanning (part of GitHub Advanced Security) automatically detects the same SQL injection vulnerability. Crucially, leveraging the power of GitHub Copilot, it not only flags the alert but also provides an AI-suggested fix directly within the pull request interface. The developer can review the suggested change, understand its rationale, and apply it directly, maintaining their workflow without context switching.

1. Secret Push Protection:

• Scenario: The developer then attempts to update the database connection settings in the settings.py file, inadvertently including a sensitive Cosmos DB secret directly in the code. They try to push this change from the command line.
• Push Protection Activation: The push is immediately rejected. The command-line output clearly states that the push was blocked because it contained an identifiable secret. A link is provided for more information.
• Impact: This demonstrates how GitHub's Push Protection prevents secrets from ever landing in a repository, saving the developer from the significant effort of rotating credentials and scrubbing Git history, and preventing potential breaches stemming from leaked credentials.

1. Artifact Attestations and Provenance with GitHub Actions and Sigstore:

• Scenario: The developer wants to build and publish a new version of a package (e.g., to PyPI) and ensure its integrity.
• Workflow Trigger: They manually trigger a GitHub Actions workflow in their repository, specifying a new version string.
• Attestation Generation: The actions.yaml workflow file includes a "generate build provenance" section. This step uses the Actions OIDC token to interact with Sigstore, obtaining a signing certificate. It then creates a cryptographically assured attestation—a statement of fact about the build (e.g., who built it, what workflow, what source code)—and stores it in a new attestation view on GitHub.
• Package Publication and Verification: The package is then published (e.g., to PyPI). Using the GitHub command-line tool (gh CLI), the developer downloads the package and runs a verification command. The CLI successfully verifies the package by checking the code signing certificate, matching hashes, and confirming its integrity.
• Detailed Provenance Inspection: A subsequent command shows all the details embedded in the attestation, including the issuer (GitHub Actions), the source repository URI, the build signer URI, and a direct link (run invocation URI) to the specific build logs on GitHub Actions. This provides an unforgeable audit trail.
• Policy Enforcement (OPA): Jacob concludes by demonstrating how an Open Policy Agent (OPA) policy (written in Rego) can leverage these attestations. This policy can enforce rules such as "only deploy packages that come from a particular repository," "only from a specific workflow," or even verify immutable identifiers of the organization, ensuring that only trusted and verified artifacts are deployed to production.

Defensive Implications

▶ Watch: Deep dive into the first pillar: software security and secrets (7:15)

The insights and demonstrations from this talk provide a clear roadmap for defenders seeking to enhance their software supply chain security posture.

1. Prioritize Secret Management and Scanning:

• Action: Immediately enable secret scanning across all repositories, both public and private. This is a foundational investment with a high return, as leaked credentials are a primary vector for breaches.
• Action: Implement Push Protection for secrets to prevent them from ever landing in version control systems. This proactive measure drastically reduces the cost and complexity of remediation.

1. Integrate Code Security Tools into Developer Workflows:

• Action: Deploy Static Application Security Testing (SAST) tools, such as GitHub Advanced Security, and integrate them directly into the developer's environment (e.g., VS Code extensions) and CI/CD pipelines (e.g., pull request checks).
• Action: Leverage AI-powered code security tools like GitHub Copilot for in-editor vulnerability detection and suggested fixes. Empower developers to fix issues "left" in the development cycle.

1. Harden Developer and Platform Authentication:

• Action: Mandate and enforce Two-Factor Authentication (2FA) for all developer accounts and privileged access to critical systems.
• Action: Actively promote and enable the adoption of Passkeys wherever supported. Passkeys offer a superior, phishing-resistant authentication experience that significantly mitigates credential theft and social engineering attacks, which account for a vast majority of data breaches.

1. Rigorous Third-Party Integration Vetting:

• Action: Establish a robust process for vetting and continuously monitoring all third-party integrations (e.g., CI/CD tools, OAuth applications, metrics platforms).
• Action: Conduct thorough threat modeling for each integration, assessing the potential impact if the third-party service or application were compromised. Limit the scope of access and permissions granted to these integrations to the absolute minimum required.

1. Automate Dependency Management:

• Action: Implement tools like Dependabot to automatically identify and update vulnerable software dependencies. Enforce policies that require timely remediation of dependency vulnerability alerts. This is a straightforward yet highly effective way to reduce the attack surface.

1. Embrace Software Provenance and Attestations:

• Action: Move beyond basic SBOMs to adopt solutions that provide cryptographically verifiable provenance for software artifacts.
• Action: Explore and integrate attestation capabilities (e.g., GitHub Actions with Sigstore for NPM packages) into your build pipelines. This creates an unforgeable audit trail linking artifacts back to their source and build processes.
• Action: Develop and implement policies (e.g., using Open Policy Agent) that leverage these attestations to enforce deployment criteria, ensuring only trusted and verified software reaches production environments.

1. Become AI-Conversant:

• Action: Security leaders and practitioners must educate themselves on AI technology and its implications for both offense and defense.
• Action: Experiment with AI pair programmers and AI-powered security tools to understand their capabilities and limitations. Recognize that AI will be an integral part of future security strategies, and avoiding it is not an option.

Key Takeaways

• Focus on Fundamentals: Prioritize core security hygiene across software, platforms, and build systems over complex, niche optimizations.
• AI is a Double-Edged Sword: Embrace AI as a powerful tool for security (e.g., vulnerability detection, abuse combat) while acknowledging its potential for misuse by threat actors.
• Prevent Secrets at the Source: Implement secret scanning and push protection to stop credentials from ever being exposed in repositories, saving significant remediation effort.
• Strengthen Developer Identity: Mandate 2FA and advocate for Passkeys to combat account takeovers, a leading cause of data breaches.
• Verify Software Integrity: Utilize provenance and attestations (e.g., Sigstore, GitHub Actions attestations) to cryptographically link build artifacts to their source and build process, enabling robust policy enforcement.
• Automate and Integrate: Leverage tools like Dependabot for automatic dependency updates and integrate security tools seamlessly into developer workflows to make security an enabler, not a blocker.

About the Speaker(s)

Jacob is the Deputy Chief Security Officer at GitHub, where he is responsible for leading the teams that secure GitHub's infrastructure, data, prevent abuse, and manage governance, risk, and compliance. With a career rooted in development, Jacob's background includes an impactful tenure at the National Security Agency (NSA). There, he began as an engineer building real-time software-defined radio systems, later helping launch and run a developer experience program, and serving as the agency's executive sponsor for open source software. He also led numerous IT initiatives and worked extensively on security. Having been at GitHub for three years, Jacob is passionate about securing the home for all developers, bringing a wealth of experience from both government and industry to the complex challenges of software supply chain security.