Elastic partners with Chainguard on Software Supply Chain security and SLSA assessment

When adopting SLSA, Elastic sought to take a threat-based approach to create an overview mapping and threat assessment of its software supply chains. There were three clear goals to accomplish in the company’s existing software supply chain security architecture, which map to many of the practices and principles outlined in the SLSA framework: 

1. Isolate to reduce impact and escalation

2. Strong access controls to maintain integrity

3. Verify software integrity at each stage of the supply chain

The Elastic SLSA assessment was the largest SLSA assessment to date. For the assessment, Chainguard used a three-phase approach: 

• Phase one: The Chainguard team focused on understanding Elastic's current state of supply chain security practices by interviewing key essential stakeholders. 
• Phase two: The Elastic team gathered information about every software supply chain that produces an artifact that gets distributed and made available to their customers, along with Elastic points of contact responsible for those supply chains. The Chainguard team interviewed these points of contact about all aspects of the supply chain, assessing them against SLSA.
• Phase three: Chainguard closed the assessment with a survey of the Elastic team to compare results from the previous phases and the completion of the assessment. 

Elastic takes advantage of a number of technologies across multiple teams to deliver code, and meeting these teams individually was an important aspect in gaining full insight into the various software supply chains. Several of the Elastic solution components are free and open, and with that, Elastic accepts contributions from open-source developers, customers, or others from the Elastic community. All this was taken into consideration across the SLSA assessment to capture existing SLSA security practices per project and recommendations for Elastic’s overall software supply chain security roadmap. 

The assessment followed SLSA v0.1, which emphasizes a set of software supply chain security practices that deal with source code, the build process, and provenance with an emphasis on machine-readability and machine-verifiability. The Open Source Security Foundation (OpenSSF) released SLSA v1.0 in April 2023, after the completion of the assessment.

As outcomes of the SLSA assessment, Elastic has implemented strategic actions to ensure the security of the Elastic software supply chain.

SLSA helps pinpoint specific risks and threats a malicious actor may attempt to disrupt development, build, and delivery systems. As a response, Elastic added over 40 new detection rules to its deployment of Elastic Security and continues to work with technology partners in source control and CI/CD orchestration on enhancing detections in these areas.

To encourage increased focus on supply chain risks among security researchers, Elastic has increased the awards for supply chain threats reported via the Elastic Security Bug Bounty. 

To provide an easy way for users to verify the provenance of Elastic container images before deploying them to any infrastructure, Elastic is now releasing all Elastic Stack container images signed with Sigstore.  

The SLSA framework is a valuable tool for assessing risks and defining specific mitigation actions. Elastic looks forward to sharing future updates on our approach and solutions for solving supply chain security challenges. 

Organizations interested in a software supply chain security assessment can contact Chainguard. And anyone interested in educational materials on SLSA can find them on Chainguard Academy. 

Learn more about Elastic Security.