Advanced cybersecurity threat mitigation using software supply chain analysis
A system and method for comprehensive cybersecurity threat assessment of software applications based on the totality of vulnerabilities from all levels of the software supply chain. The system and method comprising analyzing the code and/or operation of a software application to determine components comprising the software, identifying the source of such components, determining vulnerabilities associated with those components, compiling a list of such components, creating a directed graph of relationships between the components and their sources, and evaluating the overall threat associated with the software application based its software supply chain vulnerabilities.
1. A system for analyzing the cybersecurity threat of software applications from the software supply chain, comprising:
a computing device comprising a memory and a processor;
a software analyzer comprising a first plurality of programming instructions stored in the memory of, and operating on the processor of, the computing device, wherein the first plurality of programming instructions, when operating on the processor, cause the computing device to:
receive a software application for analysis;
identify one or more software components comprising the software application; and
send a component identifier for each software component identified to a reconnaissance engine;
a reconnaissance engine comprising a second plurality of programming instructions stored in the memory of, and operating on the processor of, the computing device, wherein the second plurality of programming instructions, when operating on the processor, cause the computing device to:
receive the component identifier for the one or more software components;
search one or more databases to identify a source of each software component;
search one or more databases to identify a vulnerability of each software component;
send the component identifier, source, and vulnerability for each of the one or more software components to a cyber-physical graph engine;
a cyber-physical graph engine comprising a third plurality of programming instructions stored in the memory of, and operating on the processor of, the computing device, wherein the third plurality of programming instructions, when operating on the processor, cause the computing device to:
receive the component identifier, source, and vulnerability for each of the one or more software components; and
construct a cyber-physical graph of a software supply chain for the software application, the cyber-physical graph comprising nodes representing the source and vulnerability of each software component of the software application and edges representing the relationships between the nodes; and
a scoring engine comprising a third plurality of programming instructions stored in the memory of, and operating on the processor of, the computing device, wherein the third plurality of programming instructions, when operating on the processor, cause the computing device to:
run one or more graph-processing algorithms on the cyber-physical graph to determine one or more paths of vulnerability in the software supply chain and a probability of occurrence for each path; and
generate a cybersecurity score for the software application based on the vulnerabilities in the software supply chain.
2. The system of claim 1 , wherein one of the databases used to identify a source of each software component is a vulnerability information database containing structured information.
3. The system of claim 1 , wherein one of the databases used to identify a vulnerability of each software component is a vulnerability information database containing structured information.
4. The system of claim 1 , further comprising a natural language processing engine comprising a fourth plurality of programming instructions stored in the memory of, and operating on the processor of, the computing device, wherein the fourth plurality of programming instructions, when operating on the processor, cause the computing device to:
retrieve structured data from a source of vulnerability information;
retrieve unstructured data from a different source of vulnerability information;
extract identifiable information regarding vulnerabilities from the structured data;
search, identify, and tag the unstructured data using the identifiable information from the structured data, thereby converting the unstructured data to newly structured data; and
storing a database comprising the newly structured data;
wherein one of the databases used to identify a vulnerability of each software component is the database comprising the newly structured data, or one of the databases used to identify a source of each software component is the database comprising the newly structured data, or both.
5. A method for analyzing the cybersecurity threat of software applications from the software supply chain, comprising the steps of:
receiving a software application for analysis;
identifying one or more software components comprising the software application;
searching one or more databases to identify a source of each software component;
searching one or more databases to identify a vulnerability of each software component;
constructing a cyber-physical graph of a software supply chain for the software application, the cyber-physical graph comprising nodes representing the source and vulnerability of each software component of the software application and edges representing the relationships between the nodes;
running one or more graph-processing algorithms on the cyber-physical graph to determine one or more paths of vulnerability in the software supply chain and a probability of occurrence for each path; and
generating a cybersecurity score for the software application based on the vulnerabilities in the software supply chain.
6. The method of claim 5 , wherein one of the databases used to identify a source of each software component is a vulnerability information database containing structured information.
7. The method of claim 5 , wherein one of the databases used to identify a vulnerability of each software component is a vulnerability information database containing structured information.
8. The method of claim 5 , further comprising the steps of:
retrieving structured data from a source of vulnerability information;
retrieving unstructured data from a different source of vulnerability information;
extracting identifiable information regarding vulnerabilities from the structured data;
searching, identifying, and tagging the unstructured data using the identifiable information from the structured data, thereby converting the unstructured data to newly structured data;
storing a database comprising the newly structured data; and
using the database comprising the newly structured data to identify a vulnerability of each software component, or to identify a source of each software component, or both.