The typical enterprise application today is composed primarily of open-source and third-party dependencies, with an organization’s own code representing a small fraction of what actually runs in production. High-profile compromises of widely used packages have demonstrated that a single poisoned dependency, several layers deep in a dependency tree, can compromise thousands of downstream applications simultaneously.
Building a bill of materials before you need one
A software bill of materials—a complete inventory of every component, its version, and its provenance—is a prerequisite for responding quickly when a new vulnerability is disclosed in a widely used library, since organizations without this inventory spend precious early hours simply determining whether they are affected. Dependency scanning should run continuously in the pipeline, not as a periodic audit, flagging known vulnerabilities and unusual package behavior before deployment.
Pinning dependency versions, verifying package signatures, and restricting which registries build systems can pull from all reduce the chance of a supply chain compromise reaching production undetected.
JIG helps engineering organizations build software supply chain security programs that provide visibility and response speed when the next widely used package is compromised.