> we need to enforce global software supply chain management now.
Well, we can't. We don't have the infrastructure for it. It will probably take every industry in the world between 4 and 10 years to have a fully secure supply chain.
> The world runs on software.
Close: it runs on hardware, and that hardware isn't secure either. It also runs on networks, and authenticated, authorized communications, and those aren't secure either.
> However, there is an even more worrying effect: if attacks are possible at such a scale that their effect is felt across whole sectors, countries or even globally, as is the case with the “SolarWinds” attack, they have the potential to fundamentally undermine our trust in information technology.
Holy shit. Nobody tell this guy about the NSA hacking Cisco, he might get really upset.
> an attack on a low system level may be able to corrupt or circumvent protective measures on higher levels.
..... Unless you design it not to.
> Equifax’s 2017 leakage of hundreds of millions of customer records, was possible because the organization failed to update a vulnerability in a low-level web server module
No. It was possible because Equifax had no accountability. It was also possible because their network and data access policies were Swiss cheese, and only after that was it the fault of somebody not patching a shitty app.
The rest of his argent is that the biggest problem we have is patching and malicious code in our stacks. But even without supply chain attacks you still have 0days which are the same problem: shitty code gets exploited.
You can't avoid shitty code. All you can do is mitigate risk. What stops big attacks is not one single fancy idea, but putting enough hoops in place to make big attacks extremely rare and difficult. That, and educating developers on how to not write shitty code and build shitty systems.
Most developers I know literally don't even know how to avoid SQLi, or if they do know how, they're too lazy or overworked to do it. They pick random shitty tech and clumsily paste it together to get some MVP working, and then that becomes production.
Nobody wants to pay for real components and solutions that were designed the right way and certified. Everybody just wants to write brand new shit code from scratch in fucking JavaScript using a randomly assembled bunch of modules a retarded hamster could write, and then make it so they can't be extended and improved over time, because they're owned by some jackass worse password is Welcome123!
Supply chain is just what's trendy. The real fix is to get people to stop trusting morons to make shitty products, and stop paying people to write custom applications that all suck.