Security in a World of Software Supply-Chain Vulnerabilities

Modern software incorporates thousands of third-party components. Bugs or security vulnerabilities in these components can seriously compromise the integrity of incorporating applications. Because of their widespread use, and the difficulty of vetting the enormous number of integrated components for vulnerabilities, they comprise a compelling target for attackers, who purposefully insert vulnerabilities into widely used components with the goal of compromising the integrity of entire software ecosystems. I will present a series of systems that leverage component boundaries to offer automated solutions to vulnerabilities that appear in the software supply chain: BreakApp implements system-level containment techniques that prevent an attack from escaping its component; Iris leverages language-based protection to offer high performance enforcement of fine-grain security policies; Mir introduces a constrained privilege model and a hybrid analysis to deliver additional automation; and Harp uses active learning to infer and regenerate domain-specific components that are guaranteed to be free of inserted software vulnerabilities. Individually, these systems focus on transparent protection against classes of threats. Combined, they provide a holistic and in-depth transformation-based approach to securing software ecosystems.