"Software Supply Chain Security at Risk"...KISA Expands Security Support Program

In order to enhance the security capabilities of the software supply chain, the government is expanding its support for establishing security systems based on the Software Bill of Materials (SBOM), which is a list of the components included in software.

On March 16, the Korea Internet & Security Agency (KISA) announced that it is recruiting companies to participate in the "Software Supply Chain Security Model Establishment Support" project, with a budget of 4 billion won, until April 9.

Until last year, the project was mainly targeted at software development and supply companies, but this year, companies that adopt and operate software are also eligible to participate. The government decided to expand the scope of support due to the rapid increase in supply chain attacks. Given the nature of software, which is built from various components such as subcontractors, external development partners, and open source, a hacking incident affecting a single company could potentially impact all related companies.

This year's project will provide up to 300 million won per project for six tasks in the "Supply Chain Security Management System" category, which aims to respond to global supply chain regulations and advance vulnerability management. In the "Supply Chain Threat Monitoring and Response System" category, which supports companies that operate software within their organizations to monitor new threats using SBOM, up to 500 million won per project will be provided for two tasks.

KISA plans to help companies introduce SBOM-based software supply chain security management systems internally, enabling them to quickly identify license violations or security vulnerabilities. The agency will also support software composition analysis (SCA) tools, servers, databases, and other equipment and infrastructure that can verify security.

Donghwa Lee, Head of the AX Supply Chain Security Policy Team at KISA, stated, "It is time for not only development companies but also operating and sales companies to participate together and consider how to utilize SBOM throughout the entire process from development to operation."

This content was produced with the assistance of AI translation services.