Can We Swap That? Substitutability and Criticality in the Open Source Supply Chain

The modern software systems are built on several dependencies. The bigger question is whether we can swap the software when needed. Alternatively, what happens if the supplier denies the upgrade or any future support? This talk introduces two important areas: substitutability (how easily we can replace the software) and criticality (the blast radius if the component fails or is compromised).
We try to answer the following questions -

1) Is there a viable alternative if the package is abandoned or modified?

2) How deeply is the component embedded?

3) What is the viable replacement path? (or time to restore)


Talk reference - Ohm, M., Plate, H., Sykosch, A., & Meier, M. (2020). Backstabber's Knife Collection: A Review of Open Source Software Supply Chain Attacks. In Proceedings of DIMVA 2020, Lecture Notes in Computer Science, vol. 12223, pp. 23–43. Springer. https://doi.org/10.1007/978-3-030-52683-2_2

1. A two-dimensional framework - substitutability and criticality, and how to place dependencies

2. Real incident examples - from a critical infrastructure perspective

3. A few guidelines for OSS maintainers.

4. Pointers for open tooling - OpenSSF, SLSA, SBOM generation