📦
Software Supply Chain
Security
Upstream components, dependencies, build pipelines, and distribution channels involved in producing and delivering software.
Definition
Software supply chain security covers risks in dependencies, CI/CD, artifact repos, signing keys, and distribution. Controls include dependency pinning, provenance, signed builds, review, and SBOMs.
In plain English
Upstream components, dependencies, build pipelines, and distribution channels involved in producing and delivering software.
Why this matters
Why it matters: Supply-chain compromise can enable large-scale malware and data exfiltration via trusted software.
Example
Example: Generate an SBOM per release, verify signatures, isolate builds, and monitor dependency changes.