Securing your application software supply-chain

Is your software supply chain your weakest link? Learn to defend against attacks with modern tools for code signing, provenance, and policy enforcement.

#1about 3 minutes

Defining the modern software supply chain

The modern software supply chain encompasses all steps from source code to deployment, growing in complexity with cloud-native development.

#2about 1 minute

Learning from the SolarWinds supply chain attack

The SolarWinds incident serves as a key example of a supply chain attack where a compromised build server injected malicious code into a signed product.

#3about 3 minutes

Securing developer access and development tools

Protect source code access by implementing multi-factor authentication and git commit signing, while also considering the security risks within your IDE's own supply chain.

#4about 5 minutes

Managing risks from third-party libraries

Mitigate risks from third-party dependencies by addressing vulnerabilities, preventing dependency confusion, and using tools like OpenSSF Security Scorecards to assess package health.

#5about 3 minutes

Ensuring integrity with reproducible builds and signing

Create verifiable software by implementing reproducible builds and using tools like Sigstore and Cosine for keyless signing of artifacts like Docker images.

#6about 4 minutes

Creating a software bill of materials (SBOM)

A Software Bill of Materials (SBOM) acts like a parts list for your software, enabling you to track all components using tools like CycloneDX and Syft.

#7about 3 minutes

Adopting the SLSA framework for supply chain maturity

The SLSA framework provides a maturity model with incremental levels to help organizations progressively secure their software supply chain.

#8about 2 minutes

Implementing and enforcing supply chain policies

Apply supply chain security in practice with validation pipelines like SolarWinds' Project Trebuchet and enforce policies using tools like Kyverno and Google's Binary Authorization.

#9about 3 minutes

Key takeaways and next steps for securing your supply chain

The key to securing your supply chain is to be aware of its complexity, integrate security from the start, and begin by generating and eventually ingesting SBOM data.