I.  Overview:

Software supply chain attacks are causing havoc in the industry! The recent high-profile attacks like Solarwinds, Log4Shell are attributed to supply chain attacks. In fact, a report found that 80% of the code in modern applications is third-party code, and a significant portion of these packages are outdated or have reached end-of-life, creating serious security and operational issues.

The CSSE Course offers a deep dive into the security risks associated with software supply chains, providing you with the knowledge and skills to identify, validate, and mitigate these risks. 

Through hands-on exercises in our browser-based labs, you will gain real-world experience dealing with supply chain attack scenarios. Once you have compromised a system, you will also fix issues to gain a comprehensive understanding of supply chain issues.

We will begin the course with an overview of the risks involved in using commercial, open-source, and proprietary third-party code. You will then explore security threats involving container and orchestration systems like Kubernetes. Finally, we will showcase the attack scenarios involving the cloud and its managed services.

In the last sections of the course, you will map risks against MITRE ATT&CK and NIST SSDF frameworks to manage supply chain security effectively.

You will also learn about the latest technologies and solutions for securing your software supply chain, as well as the role of industry standards and regulations. 

By the end of this course, you will have a comprehensive understanding of supply chain attacks in code, containers, clusters, and the cloud.

After the training, you will be able to:

• Earn the Certified Software Supply Chain Security Expert (CSSE) Certification by passing a 12-hour practical exam.
• Prove to employers and peers, a practical understanding of the supply chain risks and mitigations.

II. Duration:  40 hours

III. Objectives:

Upon successful completion of this course, students will be able to:

• Understand the role of supply chain security in protecting organisations from attacks.
• Identify the various supply chain attacks and how they can be exploited via code, container, clusters, and cloud.
• Develop strategies for assessing and mitigating supply chain risks.
• Develop an understanding of best practices for supply chain management and security, including guidance from the MITRE ATT&CK framework.

IV.  Prerequisites:

• Course participants should have knowledge of running basic Linux commands like ls, cd, mkdir, etc.
• Basic knowledge of Git, CI/CD pipelines, containers, and Cloud Platforms.
• A good understanding of OWASP Top 10 vulnerabilities.
• Familiarity with any scripting language like Python, Golang, or ruby helps. However, it’s not a necessity

V.  Course outlines:

1. Chapter 1: Introduction to Supply Chain Security

• Course Introduction (About the course, syllabus, and how to approach it) 
• About Certification and how to approach it
• Course Lab Environment
• Lifetime course support (Mattermost)
• An overview of the Supply Chain Security
• Supply Chain Security Building Blocks
  • Code Creation 

    - Source Code Management (SCM)

    - Internal and external (third-party) software inventory

    - Build system (CI/CD)

    - Application

  • Containers
  • Clusters
  • Cloud

• Threat Model of Software Supply Chain
  • Overview of Code Creation (SCM, CI/CD and Application)
  • Overview of Containers
  • Overview of Clusters
  • Overview of Cloud
• Evolution of Software Supply Chain Security
• Demo: How SolarWinds and Equifax came to be
• Hands-on Exercise: 
  • Learn how to use our browser-based lab environment
  • Equifax Data Breach

2. Chapter 2: Attacking Code/Application Supply Chain

• Introduction to code supply chain
• Code creation process and systems involved
  • Source code management (git, svn)
  • Package managers
  • Build and CI/CD systems
• Ways to abuse the trust in the supply chain pipeline
• Attacks on SCM systems
  • Abusing git server misconfigurations
  • Exploiting pre-commit hooks
  • Untrusted code in git repositories
  • Injecting malicious code into the master branch
  • Repo Jacking
• Supply Chain Attacks on package managers
  • Internal and third-party components
  • Front End Components (client side) 

    - Embedded scripts like analytics, advertising, tracking, fonts, and icons

    - Advertising Supply Chain Attacks (AdMaxim, CloudCMS and Picreel network like Megacart group)

    - Outdated and vulnerable components

    - Supply Chain Attacks on CDNs, Static assets(s3)

    - Bypassing security mechanisms like CSP

  • Back End Components (server side) 

    - Equifax hack

    - Exploiting vulnerabilities in Backend Components like Injection, RCE, and SSRF

  • Typo Squatting
  • Dependency Confusion
  • Brand Jacking

• Attacks on Build and CI/CD Systems
  • Attacking artifact repositories to inject malicious code and repositories
  • Abusing default behavior of CI/CD systems 
  • Exploiting Build and CI/CD components/plugins ( vulnerable components used by CI/CD systems)
  • Cross Build Injection (XBI) Attacks
  • Template injection Attacks
  • Abusing webhooks to compromise CI/CD systems
  • Stealing Credentials to inject malicious code in artifacts
• Attacks on Application Side
  • Injection attacks
  • Remote Code Execution
  • Server Side Request Forgery
  • Stolen code-sign certificates or signed malicious apps
• Real-World case studies of code supply chain attack
• Best practices for securing application supply chain
  • Code Signing
  • SBOMs
  • Artifact Signing
  • Pinning Dependencies
• Technologies and solutions for securing applications
• Designing and implementing application security strategies
  • SCA
  • SAST
  • DAST
  • Fuzz Testing
• Hands-on Exercises:
  • Case Study of Magecart attack on the Forbes magazine subscription site
  • The above topics will have numerous exercises 
  • Establish a vetting process for open-source components
  • Handling Dependency Hell
  • Implement Code and artifact Signing process
  • Implement SCA/SAST/DAST as part DevOps pipelines

3. Chapter 3: Attacking Container Supply Chain

• Introduction to container technology
• Ways to interact with containers ecosystem
• Overview of container security and the supply chain risks
• Attacking Container Supply Chain ecosystem
  • Malicious images
  • Vulnerable images
  • Insecure container registry
• Real-World case studies of container supply chain attack
• Best practices for securing containers applications
• Technologies and solutions for securing containerized applications
• Designing and implementing container security strategies
• Hands-on Exercises:
  • Inserting backdoors and malware into container images
  • Defenses: 

    - Reduce Bloated Dependencies 

    - Remove unused dependencies

    - Handle end-of-life packages gracefully

4. Chapter 4: Attacking Kubernetes/Cluster Supply Chain

• Introduction to Microservices and Kubernetes
• An overview of Kubernetes Architecture (Core Components)
• Supply Chain Threats for a cluster
• Kubernetes Package Manager – Helm
  • Abusing the helm charts to exploit the cluster
• Attacks on Admission Controllers
• Exploiting k8s misconfigurations like RBAC, webhooks
• Leveraging CI/CD tools in Kubernetes like ArgoCD and Registries to gain a foothold in cluster
• Real-World case studies of cluster supply chain attack
• Best practices for securing clusters
• Technologies and solutions for securing container orchestration
• Hands-on Exercises:
  • Kubectl basics commands
  • Kubernetes Reconnaissance
  • Reconnaissance using Kube-hunter
  • Exploiting Privileged Pods
  • Pwning Kubernetes cluster through pods pivoting
  • Compromising Kubernetes secrets
  • Supply chain attacks using the poisoned image and malicious helm charts
  • Escalating the cluster privileges using webhooks
  • Maintaining a foothold in the cluster using malicious packages
  • Full attack walkthrough from container to cluster access

5. Chapter 5: Attacking the cloud supply chain

• Introduction to Cloud ecosystem (Public, On-Premise)
• Cloud Attack Surface and Threat Matrix
• Shared Security Model of the Cloud
• Attack Vectors in AWS
  • Misconfigurations (Expose secrets, metadata service, etc.)
  • Attacking managed services like S3, CloudFront CDN
  • Serverless 
  • App
• Best practices for securing the cloud
• Technologies and solutions for securing container orchestration
• Hands-on Exercises:
  • Attacking managed services like S3, and CloudFront CDN to insert backdoors into the scripts.
  • Abusing AWS metadata service (SSRF) to steal credentials
  • Complete compromise of AWS account from code to cloud
  • Maintaining a foothold in the cloud using malicious packages

6. Chapter 6: Common Defense against Supply Chain Attacks

• Prove the sanity of the software components using Cryptography
  • Code Signing
  • Component Signing
  • Artifact signing 
• Evaluate dependencies before use
  • Analyse the security and compliance of dependencies
• Implement integrity checks or policies
• Implement Change Control
  • Protected Branches
  • Licensed Code
  • Configuration management and change control
• Create asset Inventory
• Generate a Software Bill Of Materials (SBOM)
  • Application
  • Container
  • Hosts (Virtual Machine Image)
• Code Isolation and Sandboxing
• Automation of Common Controls in CI/CD
  • Software Component Analysis of Code, Container, Clusters, and Cloud
  • Static Security Analysis of Code, Container, Clusters, and Cloud
  • Dynamic Security Analysis of, Container, Clusters, and Cloud
  • Fuzz testing of Code, Third party components, and Clusters
• Compliance and Governance of Supply Chain Risk
• Hands-on Exercises:
  • Identify malicious packages/third party
  • Generate SBOM for application and container
  • Handling Dependency Hell

7. Chapter 7: Managing a Secure Software Supply Chain Program

• Problems with current Supply Chain Attack Visibility
  • Detection of only known vulnerabilities
  • Detection of unknown vulnerabilities
• Creating a vetting process for software components(Commercial, Open Source, Third Party, and Proprietary Code) used throughout SDLC 
• Automation of vetting and third-party code
• Software Supply Chain Industry Standards and Best Practices
  • NIST C-SRM or SLSA 
  • NIST SSDF
  • Software Component Verification Standard (SCVS)
  • Supply Chain Integrity Model
  • SBOM
  • CycloneDX
  • OpenSSF  – Automated
• Core Infrastructure Initiative  – Self Assessment

8. Practical DevSecOps Certification Process

• After completing the course, you can schedule the CSSE exam on your preferred date.