Supply Chain Security Guide
Overview
Welcome to the AppSec Atlas Supply Chain Security Guide. In modern software development, a large portion of the application code originates from third-party dependencies, open-source libraries, and external services. This chapter covers how to secure the software supply chain against attacks, ensure the integrity of the build process, and manage the vulnerabilities introduced by dependencies.
Prerequisites
Before diving into this guide, you should have a basic understanding of:
- Software development lifecycles (SDLC) and CI/CD pipelines.
- Package managers (e.g., npm, pip, Maven, Cargo).
- Basic cryptography concepts (e.g., digital signatures, hashing).
Learning Objectives
By completing this guide, you will be able to:
- Understand the Software Supply Chain threat landscape.
- Generate and analyze Software Bill of Materials (SBOMs).
- Implement the Supply-chain Levels for Software Artifacts (SLSA) framework principles.
- Use dependency pinning and lockfile hardening.
- Detect and prevent the integration of malicious packages or typosquatting attacks.
- Secure the software publishing process.