SolarWinds unveils its new next-generation build system, a transformational model for software development.
The new software build process is a key part of the company’s Secure by Design initiative to establish SolarWinds as the model for enterprise software security.
Software development and build process improvements have been made on an accelerated schedule over the past year in response to the highly sophisticated SUNBURST cyberattack, which targeted SolarWinds and other technology companies. The next-generation build system includes both new software development practices and technology to strengthen the integrity of the build environment. This is the first “parallel build” process of its kind, where development of SolarWinds software occurs through multiple, highly secure duplicate paths to establish a baseline for integrity checks.
Because the software building process at SolarWinds used at the time of the SUNBURST attack is common in the technology industry, SolarWinds is releasing components of the new build system as open source software, allowing other organizations to benefit from company learnings and help set a new industry standard for secure software development.
“Transparent communication and industry collaboration is the only way to effectively protect our shared cyberinfrastructure against evolving threats,” said Sudhakar Ramakrishna, President and CEO of SolarWinds. “Our Secure by Design initiative aims to set a new standard in software supply chain security through innovations in build systems and build processes. We believe our customers, peers, and entire industry can also benefit from our practices.”
SolarWinds has aligned the next-generation building system with four key tenets of safety-by-design principles:
- Dynamic operations: Build only short-term software build environments that self-destruct after completing a specific task.
- Systematic building products: Ensure that construction products can be made deterministically so that all newly created by-products always have identical and secure components.
- Simultaneous build process: Creation of software development by-products, such as data models, in parallel to establish a basis for detecting unexpected product changes.
- Detailed files: Follow-up of each stage of software construction for complete traceability and permanent proof of registration.