Software Supply Chain Security

  1. Frameworks, Standards, and Governance
    1. Key Frameworks
      1. Supply-chain Levels for Software Artifacts
        1. SLSA Levels and Requirements
          1. Level 1: Documentation
            1. Build Process Documentation
              1. Provenance Generation
                1. Basic Attestations
                2. Level 2: Build Service Security
                  1. Hosted Build Service
                    1. Source Integrity
                      1. Build Service Authentication
                      2. Level 3: Build Provenance
                        1. Non-Falsifiable Provenance
                          1. Isolated Build Environment
                            1. Parameterless Builds
                            2. Level 4: Two-Person Review and Hermetic Builds
                              1. Two-Person Review
                                1. Hermetic Builds
                                  1. Reproducible Builds
                                2. Achieving SLSA Compliance
                                  1. Implementation Steps
                                    1. Assessment and Planning
                                      1. Tool Selection
                                        1. Process Implementation
                                        2. Assessment and Verification
                                          1. Compliance Auditing
                                            1. Continuous Monitoring
                                              1. Certification Processes
                                          2. NIST Secure Software Development Framework
                                            1. Core Practices
                                              1. Prepare the Organization
                                                1. Protect the Software
                                                  1. Produce Well-Secured Software
                                                    1. Respond to Vulnerabilities
                                                    2. Implementation Guidance
                                                      1. Practice Implementation
                                                        1. Measurement and Metrics
                                                          1. Continuous Improvement
                                                        2. CIS Software Supply Chain Security Benchmark
                                                          1. Benchmark Controls
                                                            1. Control Categories
                                                              1. Implementation Levels
                                                                1. Scoring Guidelines
                                                                2. Assessment Tools
                                                                  1. Automated Assessment
                                                                    1. Manual Verification
                                                                      1. Reporting Capabilities
                                                                    2. OWASP Software Component Verification Standard
                                                                      1. ISO/IEC Standards
                                                                        1. ISO/IEC 27001
                                                                          1. ISO/IEC 27034
                                                                        2. Policy as Code
                                                                          1. Defining Security and Compliance Policies in Code
                                                                            1. Policy Languages and Frameworks
                                                                              1. Rego Language
                                                                                1. YAML-Based Policies
                                                                                  1. JSON Schema Validation
                                                                                  2. Policy Development Lifecycle
                                                                                    1. Version Control for Policies
                                                                                    2. Tools for Policy Enforcement
                                                                                      1. Open Policy Agent
                                                                                        1. Policy Authoring
                                                                                          1. Decision Engine
                                                                                            1. Integration Patterns
                                                                                            2. Other Policy Engines
                                                                                              1. Falco
                                                                                                1. Gatekeeper
                                                                                                  1. Conftest
                                                                                                2. Integrating PaC into CI/CD
                                                                                                  1. Policy Checks in Pipelines
                                                                                                    1. Pre-Deployment Validation
                                                                                                      1. Continuous Compliance
                                                                                                        1. Automated Remediation
                                                                                                        2. Automated Enforcement
                                                                                                          1. Real-Time Policy Enforcement
                                                                                                            1. Violation Handling
                                                                                                              1. Exception Management
                                                                                                          2. Governance and Compliance
                                                                                                            1. Establishing a Secure Software Development Lifecycle
                                                                                                              1. Security Gates and Reviews
                                                                                                                1. Design Reviews
                                                                                                                  1. Code Reviews
                                                                                                                    1. Security Testing
                                                                                                                    2. Secure Coding Standards
                                                                                                                      1. Coding Guidelines
                                                                                                                        1. Security Requirements
                                                                                                                          1. Training Programs
                                                                                                                          2. Risk Management Integration
                                                                                                                          3. Auditing and Monitoring
                                                                                                                            1. Continuous Monitoring
                                                                                                                              1. Security Metrics
                                                                                                                                1. Compliance Dashboards
                                                                                                                                  1. Alerting Systems
                                                                                                                                  2. Audit Trail Management
                                                                                                                                    1. Log Collection
                                                                                                                                      1. Evidence Preservation
                                                                                                                                        1. Forensic Capabilities
                                                                                                                                        2. Third-Party Audits
                                                                                                                                        3. Regulatory Requirements
                                                                                                                                          1. US Executive Order 14028
                                                                                                                                            1. SBOM Requirements
                                                                                                                                              1. Security Standards
                                                                                                                                                1. Federal Compliance
                                                                                                                                                2. Other Relevant Regulations
                                                                                                                                                  1. GDPR Implications
                                                                                                                                                    1. Industry-Specific Requirements
                                                                                                                                                      1. International Standards
                                                                                                                                                    2. Risk Management
                                                                                                                                                      1. Risk Assessment Frameworks
                                                                                                                                                        1. Risk Mitigation Strategies
                                                                                                                                                          1. Business Continuity Planning

                                                                                                                                                      Previous

                                                                                                                                                      8. Software Bill of Materials

                                                                                                                                                      Go to top

                                                                                                                                                      Next

                                                                                                                                                      10. Incident Response and Recovery