Supply Chain Security

Software supply chain security encompasses the practices and controls that protect the integrity of code, dependencies, and build processes from source through deployment. Attacks like SolarWinds and XZ Utils demonstrated that compromising a build tool or upstream dependency can affect thousands of downstream consumers.

Key controls include SBOMs, dependency pinning, provenance attestation, and signed artifacts.