Advanced cybersecurity threat mitigation using software supply chain analysis
A system and method for comprehensive cybersecurity threat assessment of software applications based on the totality of vulnerabilities from all levels of the software supply chain. The system and method comprising analyzing the code and/or operation of a software application to determine components comprising the software, identifying the source of such components, determining vulnerabilities associated with those components, compiling a list of such components, creating a directed graph of relationships between the components and their sources, and evaluating the overall threat associated with the software application based its software supply chain vulnerabilities.
1 . A system for analyzing the cybersecurity threat of software applications from the software supply chain, comprising:
a computing device comprising a memory and a processor;
a plurality of programming instructions stored in the memory of, and operating on the processor of, the computing device, wherein the plurality of programming instructions, when operating on the processor, cause the computing device to:
receive a component identifier for each of one or more software components of a software application;
search one or more databases to identify a source of each software component;
search one or more databases to identify a vulnerability of each software component;
construct a cyber-physical graph of a software supply chain for the software application, the cyber-physical graph comprising nodes representing the source and the vulnerability of each software component of the software application and edges representing the relationships between the nodes;
run one or more graph-processing algorithms on the cyber-physical graph to determine one or more paths of vulnerability in the software supply chain and a probability of occurrence for each path of vulnerability; and
generate a cybersecurity score for the software application based on the one or more paths of vulnerability in the software supply chain and the probability of occurrence for each path of vulnerability.
2 . The system of claim 1 , wherein one of the databases used to identify the source of each software component is a vulnerability information database containing structured information.
3 . The system of claim 1 , wherein one of the databases used to identify the vulnerability of each software component is a vulnerability information database containing structured information.
4 . The system of claim 1 , wherein the plurality of programming instructions further cause the computing device to:
retrieve structured data from a source of vulnerability information;
retrieve unstructured data from a different source of vulnerability information;
extract identifiable information regarding vulnerabilities from the structured data;
search, identify, and tag the unstructured data using the identifiable information from the structured data, thereby converting the unstructured data to newly structured data; and
store a database comprising the newly structured data;
wherein one of the databases used to identify the vulnerability of each software component is the database comprising the newly structured data, or one of the databases used to identify the source of each software component is the database comprising the newly structured data, or both.
5 . A method for analyzing the cybersecurity threat of software applications from the software supply chain, comprising the steps of:
receiving a component identifier for each of one or more software components of a software application;
searching one or more databases to identify a source of each software component;
searching one or more databases to identify a vulnerability of each software component;
constructing a cyber-physical graph of a software supply chain for the software application, the cyber-physical graph comprising nodes representing the source and the vulnerability of each software component of the software application and edges representing the relationships between the nodes;
running one or more graph-processing algorithms on the cyber-physical graph to determine one or more paths of vulnerability in the software supply chain and a probability of occurrence for each path of vulnerability; and
generating a cybersecurity score for the software application based on the one or more paths of vulnerability in the software supply chain and the probability of occurrence for each path of vulnerability.
6 . The method of claim 5 , wherein one of the databases used to identify the source of each software component is a vulnerability information database containing structured information.
7 . The method of claim 5 , wherein one of the databases used to identify the vulnerability of each software component is a vulnerability information database containing structured information.
8 . The method of claim 5 , further comprising the steps of:
retrieving structured data from a source of vulnerability information;
retrieving unstructured data from a different source of vulnerability information;
extracting identifiable information regarding vulnerabilities from the structured data;
searching, identifying, and tagging the unstructured data using the identifiable information from the structured data, thereby converting the unstructured data to newly structured data;
storing a database comprising the newly structured data; and
using the database comprising the newly structured data to identify the vulnerability of each software component, or to identify the source of each software component, or both.