Cloud Native Computing Foundation SupplyChainSecurityCon hosted by CNCF + CDF 2021, 30 Oct 2021

Previous Meeting

Next Meeting

⏯

youtube image

►

From YouTube: 5G and Challenges with Software Supply Chain Security - Fatih Degirmenci, Ericsson

Description

Don’t miss out! Join us at our next event: KubeCon + CloudNativeCon Europe 2022 in Valencia, Spain from May 17-20. Learn more at https://kubecon.io The conference features presentations from developers and end users of Kubernetes, Prometheus, Envoy, and all of the other CNCF-hosted projects.

5G and Challenges with Software Supply Chain Security - Fatih Degirmenci, Ericsson

The new technologies such as cloud, containers, virtual & cloud native network functions result in tremendous advances in the telecommunications industry.
With the help of these new technologies, the 5G networks that are currently being rolled out all around the world are developed rapidly in heavily disaggregated manner, allowing communications service providers to introduce new services to their users much faster than before.

However, the new technologies and resulting disaggregation is not without their challenges and the security of the software supply chain is one of them.
The components that are part of the 5G networks originate from multiple sources, including but not limited to vendors and open source communities with many integration points and deployed into different environments such as public and private clouds, increasing the risk of breaking the chain of trust.

This session will give a short overview of the next generation telecommunications networks, highlight the challenges, and talk about the opportunities to tackle them in a collaborative manner.

A

Hi all thank you for joining this session 5g and challenges with software supply chain security. My name is fat tirmanji. I work for erickson software technology as open source developer during the coming 15 minutes. I will talk about transformation. Telecom industry 5g the changes we are witnessing the impacts of those changes on software supply chain and challenges we are facing.

A

As you know, mobile communication is part of our lives and over the past 40 years we have seen tremendous changes within communication.

A

If we even go back 150 years, we can see that communication happened through wires via telephones, but since 1980s the mobile communication has become critical part of our lives and, as we all know, every ten year we are seeing new generations of mobile communication, starting with 1g, going through 2g 3g 4g and finding 5g networks that are currently being rolled out all around the world today, and I want to look at last 10 years and what's been happening within telecommunications industry.

A

The new technologies such as cloud native and virtualization, opened up out of opportunities for various industries and telecom is not an exception, and around 2014 european telecommunications standards institute published a white paper describing how virtualizations could be employed in telecommunications, industry and network functions. Virtualization start becoming the focus for the industry and, as you can see on this picture, which is taken from the first white paper, it's published around 2014.

A

The shift from classical network appliance approach to virtualized and segregated approach is critical for the next generation telecom networks. The reason for this is that the purchase virtualized approach allows this. Segregation enables vendor diversity, enables innovation as a piece of the introduction of these services to end users.

A

As part of this white paper, she came up with an fv architecture and that also talks about the different components within the next generation telecom networks and puts the focus on openness and enabling innovation.

A

So what was that architecture? I took very simplified view of that architecture and if you look at the left hand side diagram, you will see how the telecom networks in the past and even today are built and rolled out.

A

The classical approach involves the use of specialized hardware and software and deploying physical network functions in that kind of setup and, as you can see on the diagram, this is very coupled highly integrated and it is very difficult to bring in new services or applications into networks.

A

But if you look at the diagram on the right hand, side, you will see that with virtual network functions and cloud native network functions, you can decouple different layers within the telecom stack and bring those different applications or components within the setac from different vendors in a much faster pace.

A

And the other thing I want to highlight here is openness and standardization, and in the past again specialized specialized hardware and software and the use of property. Hardware and software made things difficult for communication service providers to bring in new products and new applications into their environments.

A

But with this decoupling and openness, many new applications could be developed by various vendors and they could be prior to communication service providers. So desegregation and openness are the two key things that is pushing telecommunications industry forward and the new technologies, as I mentioned, virtualization and cloud native, are becoming part of telecom stack.

A

So what kind of challenges we are observing on this diagram? I have very simple software supply chain and various actors. On the left hand side we have communities and vendors on right hand, side.

A

We have telecom networks that could either be deployed into data centers cloud or edge and in the middle we have communication, service provider or mobile network operator, and when it comes to communities, it could either be a community or a standalone project to open a certain piece of technology that could be used as dependency for other open source technologies, or it could be an entire platform such as kubernetes.

A

And when it comes to vendors, the vendors could be developing their products in their environment without consuming any op source compounds or they could be consuming open source compounds from various committees and projects and in most cases, telecom stack contains out of open source components.

A

And if we look at the first challenge we are facing is false introduction.

A

Obviously, the vendor, who is developing product x, need to bring in certain dependencies from upstream committees if they are using open source components within their product development, and this is the first thing the vendors face, how to bring those force components into their product development organizations and how to introduce those components and, as we all know, free and open source has different licensing types or those components could have different types of security and vulnerability issues and all those issues or license types types must be vetted before the software could be introduced to product development organization, and this is the first challenge how we can introduce new force or newer versions of existing force components into our product development in a fast and satisfying manner.

A

Next, challenge is again due to this disaggregation many different compounds are developed and published by various open source quantities and when these components are consumed from upstream communities and put together products, the communication service providers are acquiring from the vendors they need to face the challenges because of integration, and especially with integration.

A

It is very important to keep the chain of trace traceability and reproducibility aspects in mind, so when things are integrated with each other or put together, the critical information about those components are not post in translation.

A

Another important and related challenge is software, build of materials and again during force introduction phase.

A

We need to identify primary 3pp or force and its dependencies and what kind of licensing type those open source components adopt and if there are any changes in those licensing types when we move to newer version and software bill of materials is critical for us to be ensure that whatever we are bringing into our product, development and lately to production is well documented and we have full bill of materials for those components.

A

Another challenge is actually mostly related to open source committees, open source developers to us non-secure development. Obviously we all know our best when we contribute to various communities. We are engaged in or the projects we are developing and it is critical. We apply securities practices properly. However, this is not followed up by majority of developers.

A

According to linux foundation, developer survey, only 2.27 percent of developers are actually applying security practices during their day-to-day work within communities they are engaged in. So it is critical for us as developers to follow these practices, apply best practices and ensure whatever record we are contributing, satisfies secure development principles, and the next issue is again going back to security development.

A

There will be bugs and there will be security issues because we are, depending on other open source components and those components may have security issues, but those issues most of time stay invisible again. If I must refer to a survey, github optor octoverse report says that the issues go undetected undeclared for about four years in average, so we must make sure that we apply security practices and if we can't fully secure our software, we then need to make sure we catch those security issues in a timely manner.

A

So those issues don't have to propagate in to the our production environments, so propagation again is related to secure development and persistence.

A

So if we have a bug in one of the critical dependencies that park could propagate through our pipelines and could be deployed to production environments, in this case telecom networks, if they are not caught on time- and this obviously increases the attack surface for malicious actors- and it could cause big problems for us as humans.

A

Vulnerability analysis is another issue again. It is important to identify what kind of analytics software we are using, have and get those vulnerabilities patched fixed by moving to newer versions of those dependencies or components assuming they become available and osp released. Their report and using software with normal libraries is the ninth biggest reason for issues with software supply chain and, finally, traceability is critical.

A

Again, we will have bugs in our software like any other community and we will need to issue fixed stores, but for those bugs including security issues. But in order for us to achieve that, we have to make sure that we have ways to trace the software that is deployed in production back to its origin and potentially identify problematic, commit to fix the issue and bring those fixes back to production environment, so trace width is critical and communities have a big old play here.

A

So, as I mentioned, telecom has been going on a heavy transformation and all this virtualization and cloud native is changing how the next generation tech telecom networks are developed and deployed, and 5g is the generation where this desegregation and openness is happening and telecom is not fundamentally different. If you look at from this perspective, because these new technologies have been available in other industries and telecom is other than these new technologies as well and improv that the use of force in telecom is increasing drastically.

A

But the difference when it comes telecom is telecom is highly regulated and heavily standardized industry. It takes quite some time for telecom to adopt new methodologies new technologies, so they become available within our networks or we need to have that and communities have a big role to play here. Again, committees have had of opportunities to impact telecom networks like how the communities did for other industries, because we sit at the international intersection of government organizations, sqos industries and other communities.

A

So if we could achieve cross-pollination and cross-collaboration across different industries, standards, development organizations, communities and government agencies, the benefits could be tremendous. Thank you very much.