Who Writes Your Source Code

Our IT supply chain perspective provides a set of layers of trusted software providers or producers, starting from the firmware burned into hardware elements on up:

• Major hardware and systems vendors
• Third-party developers, producing custom software for an organization or

typically have very strong, robust, and trustworthy processes to ensure the tailoring commercially available software integrity and security of their products. products to meet its needs, should only be engaged (put on contract) if the

• Applications software providers may

parties can agree to how they will provide be major companies whose products and assess the security of that software serve millions if not billions of end and its support.

users. Secure and reliable update and

• In-house developers, working within

support processes, when provided, add to their products' marketability and formalized software quality assurance, configuration management, and security trustworthiness. assessment environments, provide the organization as much control over and accountability of the safety and security of the code they produce as the organization wants to invest in achieving. Module 6 goes into strengthening the security of an organization's in-house software development capabilities in more detail.

• Open source providers may offer a range of after-download support and update services, or little or no after-download support at all. That support may or may not be provided in any secure or verifiable means (such as via digitally signed downloads). Open source software can also be available as shareware or freeware (referring to whether any payments or sustaining support are part of the deal).
• Citizen programmers are members of the organization who codify work-related knowledge, insights, and ideas into varying degrees of reusable software-like forms. Scripts, fourth-generation "nonprogramming" programs, and related functionality is often developed by end users within the organization, sometimes by downloading an example (from almost anywhere on the internet) and making

minor modifications to it.

On the plus side, this user extensibility of almost all commercial software apps provides smart organizations with significant competitive advantage, if they are savvy enough to use it effectively and safely. On the minus side of the ledger, however, the very ad hoc nature of these pieces of functionality are extremely difficult to manage, control, verify, or assess. These almost overwhelmingly are beyond the reach and visibility of the organization's software quality, configuration management, or security assessment processes. Such "citizen programming" is often done with little regard to security requirements and can pose a significant risk to some organizations.

Finally, we get to mobile code. Mobile code is perhaps the least inherently trustworthy form of software imaginable. Its development is beyond any reasonable efforts of the receiving systems' owners to have visibility of or influence over. As a result, organizations and individuals must depend upon the full spectrum of anti-malware, antivirus, intrusion detection, and other defensive means.