Exploring the Threat of Software Supply Chain Attacks on Containerized Applications

Containerization has become a widely adopted approach for running contemporary software services, with its ingenious layering of Free Open Source Software (FOSS) libraries and packages. The security of containers heavily relies on the integrity of their underlying dependencies, making vulnerability assessment a critical focus for security professionals. However, the landscape has evolved, and recent software supply chain attacks have illuminated a pressing need to shift the focus beyond individual vulnerabilities and delve into the overall security of their supply chain. In this paper, we embark on a data-driven analysis of container threats by examining the security characteristics of software supply chains in their open source dependencies. Leveraging a comprehensive dataset of containers from Docker Hub, our study employs Software Supply Chain metrics like the OSSF scorecard and Software Bill of Material (SBOM) tooling to compile dependency lists. The analysis delivers valuable insights to the security community, empowering them to adopt more effective measures in thwarting and mitigating software supply chain attacks, thereby enhancing the resilience of modern software services.