Dependencies and data breaches: How to keep your application safe | Isotoma: Our blog
Summary
There’s plenty of guidance about best practice in data security for businesses and organisations, but much of this tends to focus on anti-malware, user privileges and system monitoring. In April 2021, security researchers at SonarSource identified a vulnerability in the source code of Composer, a PHP tool used to manage and install software dependencies. The vulnerability allowed the researchers to execute commands in Packagist, an online service which Composer uses to determine the correct supply chain for package downloads. The vulnerability was identified and patched without being exploited (to Packagist’s knowledge), but the fact that this was a major tool used to manage dependencies highlights the inherent risks in software supply chains. It emphasises the importance of keeping code up to date, your system secure and making sure your software is working the way you expect it to.