How defence secures modern software supply chains with D2S

Modern software development introduces complex supply chains which are difficult to manage, monitor, assure and guarantee are free of cyber threats.

For Defence, the challenge is how to enable rapid delivery without losing control of security and assurance. Defence Developer Services (D2S) is the authorised solution that addresses this directly.

What is D2S

Defence Developer Services (D2S) provides end-to-end application development services across the MOD.

This includes modern containerisation platforms, backed by an integrated tooling suite within a Continuous Integration / Continuous Deployment (CI/CD) environment,

allowing Development, Security and Operations (DevSecOps) teams to build

applications across platforms. These components represent the current service and will continue to evolve and expand.

D2S’ vision is to provide a service that enables users across Defence to rapidly and securely develop and deploy applications for a range of use cases, including military operations.

Through innovative solutions and cyber security governance, risk and compliance processes, D2S facilitates a through-life “code to commit in 24 hours” service.

D2S operates within MOD infrastructure, including cloud-hosted environments, and continues to develop capabilities that support emerging technologies, including

artificial intelligence, as part of the application development lifecycle.

A unified model for supply chain security

D2S is an established multi-disciplinary team currently consisting of MOD, Digital Allies, Red Hat and Defence SMEs, working under a single mission goal.

Under an innovative assurance framework, Continuous Authority to Operate (CAtO), application teams engage with a pipeline of security tooling that provides in-depth security checks to validate and assure the entire application development supply chain.

This automation and validation process has been accessible in D2S since 2023 and continues to be the only programme to operate under CAtO in Defence.

Applications being developed in D2S benefit from a rapid but secure route to security

assurance owing to automated security validation steps, fulfilling the rapid deployment vision of the service.

Securing the platform and runtime

D2S platform services are entirely hosted within MOD infrastructure and sit within containerised hosting environments.

Specifically, D2S currently resides within Red Hat OpenShift Container Platform (OCP), where each application team resides in its own Kubernetes container across development and production environments.

Using Kubernetes offers a layer of security and operational assurance to each

application team. Containerised applications are virtually segmented from other teams hosted on the same platform. Negative effects such as technical failure or cyber security incidents within one container cannot affect another, limiting the blast radius.

OCP allows application teams control of networking, services such as databases, storage and image repositories, secrets management and access to a library of

operators, all within defined security and operational parameters of the overall service.

All environments are subject to 24/7 security monitoring by a MOD-provided Security Operations Centre (SOC).

Controlling code, access and secrets

Teams commit code to a dedicated, access-controlled instance of GitHub, managing both public and private repositories.

D2S CI/CD services pull code into development environments where users test integration with D2S services and runtime.

Development environments are protected through MOD infrastructure and OCP to prevent internet access, except where services are benign and subject to testing.

D2S provides a secrets vault allowing managed, programmatic access to securely

stored secrets such as API keys or credentials. Applications call secrets from the vault, which are rotated frequently as required.

Embedded, non-bypassable security validation

Code is regularly scanned by a pipeline of security tooling providing compliance and defence-in-depth assurance.

These steps are mandated within the CI/CD pipeline and cannot be circumvented. Applications undergo:

• Static Application Security Testing (SAST) to identify vulnerabilities prior to deployment
• Dynamic Application Security Testing (DAST), using automated attacks in a simulated runtime environment to identify vulnerabilities
• Image scanning to provide visibility of vulnerabilities (CVEs) and software composition
• Software Bill of Materials (SBOM) generation in user-friendly or JSON format
• Supply chain analysis across all components, whether integrated or inherited
• Dependency tracking to identify risks and unused components
• Secret scanning, verified by D2S Security Teams prior to deployment

Teams also undertake risk analysis and security validation, including alignment to NIST 800-53 controls, which is verified.

Managing supply chain complexity

The use of open-source code is essential in the rapid development of applications. It enables efficient build, rapid solutions, prevention of repetition and modular design patterns.

However, this introduces risk through extensive supply chains which are difficult to manage, monitor, assure and guarantee are free of cyber threats.

D2S mitigates this through extensive tooling, monitoring, established processes and continuous risk management. Security policies and processes alert application and security teams to newly identified vulnerabilities over time, with validation checks in place to ensure remedy.

Assured path to production

Applications follow a defined Path to Production process.

D2S and application teams mutually agree any residual risk associated with deployment, alongside its management and application support plans. Upon agreement, applications can deploy.

Containers in the development environment are cryptographically signed with a digital signature. These are deployed into production, where the signature is verified before execution, ensuring the container is as intended and free from interference.

Continuous assurance at scale

D2S provides an end-to-end DevSecOps service using security tooling to ensure integrity and safety in the software development lifecycle for Defence users.

Through Continuous Authority to Operate, assurance is continuously maintained and reported live, with data available for MOD scrutiny.

As assurance runs continuously, it is not subject to expiry. Services remain authorised provided standards are maintained.