DataTerminology.comNEW
Also known as: Software Supply Chain Security
Protecting software and data dependencies from compromise through provenance, signing, and controls.
DESCRIPTION
Supply chain security addresses risks from external components, tools, and services in software delivery. It emphasizes verifiable provenance, reproducible builds, attestations, code signing, SBOMs, and dependency hygiene. Frameworks like SLSA and NIST SSDF provide practices to prevent tampering and ensure integrity. Open ecosystems such as Sigstore enable transparent verification via public logs. Robust supply chain security reduces exposure to malicious packages, build system intrusions, and artifact substitution.
ALTERNATIVE DEFINITIONS
SLSA
SLSA is a security framework that improves the integrity of software artifacts and helps prevent tampering.
Focuses on artifact integrity via levels and attestations.
NIST
The SSDF provides a set of fundamental, sound practices to help secure software development.
Emphasizes baseline secure development practices for supply chain risk reduction.
CISA
The SSDF encourages organizations to incorporate secure practices throughout the software development life cycle to reduce risk, including supply chain threats.
Stresses lifecycle coverage and supply chain threat mitigation.
RELATED TERMS
SBOM SLSA Sigstore Provenance Code Signing DevSecOps Zero Trust Dependency Management Secure Build SSDF
COMPETING TERMS
Software Supply Chain Attacks Application Security
RELATIONS
- Broader: Security
KNOWLEDGE AREAS
Software Engineering Data Security Cloud Platform & Tooling
TARGET AUDIENCE
DevOps Engineer Software Developer Security Architect Cybersecurity Engineer Chief Information Security Officer
EXTERNAL SOURCES
- Wikipedia - Software supply chain
- SLSA - SLSA levels specification
- Sigstore - Open signing and verification ecosystem
- OWASP - Component verification standard
TOP QUESTIONS
What is the origin of Supply Chain Security in software?
High-profile compromises of build systems and package repositories highlighted systemic risks. This led to frameworks like SLSA and SBOM initiatives gaining prominence.
Category: Origin
Why is Supply Chain Security still relevant?
Modern software depends on extensive third-party code and services. Attackers target these dependencies to bypass traditional defenses. Integrity and provenance controls are essential.
Category: Relevancy
How is Supply Chain Security managed?
Implement SBOMs, signed artifacts, reproducible builds, provenance attestations, and dependency scanning. Enforce policies via CI/CD, artifact registries, and periodic audits.
Category: Management
What are common mistakes around Supply Chain Security?
Relying only on vulnerability scanning without provenance is insufficient. Ignoring build system hardening or failing to verify signatures leaves gaps.
Category: Mistakes
What risks exist in Supply Chain Security?
Build pipeline tampering, malicious dependencies, compromised credentials, and artifact substitution can lead to widespread compromise across environments.
Category: Risk
What are key requirements for Supply Chain Security?
Adopt a framework (SLSA/SSDF), maintain SBOMs, enable signing and verification, harden CI/CD, and monitor registries and upstream repositories.
Category: Requirements
What is a hot topic around Supply Chain Security?
Attestations in CI workflows, in-toto, and policy-as-code for verifying provenance before deployment are gaining traction.
Category: Topic
What is the biggest misunderstanding about Supply Chain Security?
It’s not just dependency scanning; it requires end-to-end integrity from source to runtime, including builds, registries, and deployment.
Category: Misunderstanding
What’s a good starting point for Supply Chain Security?
Implement artifact signing with Sigstore, generate SBOMs, and adopt SLSA Level 1 practices to build foundational provenance.
Category: Example