Software supply-chain attack
A software supply-chain attack compromises a trusted software component, provider, development process, or distribution channel to affect downstream systems or users.
Infrastructure as Code, Patterns and Practices: With examples in Python and Terraform
A supply-chain attack compromises software, infrastructure, or dependencies through a provider, maintainer, distribution channel, or development process.
- How it is used
- Protects infrastructure-as-code adoption by assessing modules and tools before they enter organizational environments.
- How deep it goes
- Defines the attack and gives a practical screening, isolation, testing, and approval workflow, while acknowledging that risk assessment is simplified.
- Examples
- Uses leaked passwords during dry runs, unauthorized HTTP endpoints, isolated module deployments, and security and compliance tests.
- What you can do after
- Evaluate and approve infrastructure modules or tools through code review, isolated testing, scanning, and security and compliance verification.
Software Security for Developers
A security attack that compromises software components, providers, or delivery processes to affect downstream applications.
- How it is used
- Protects applications by treating dependencies and external providers as part of the security boundary.
- How deep it goes
- Explains dependency compromise through an incident and gives practical scanning, validation, rescanning, and upgrade practices.
- Examples
- Uses the Event-Stream backdoor, Copay wallet versions 5.0.2–5.1, and a legacy Java library blocking upgrades.
- What you can do after
- Operate/configure dependency scanning and CI/CD checks to detect, block, and rapidly patch vulnerable libraries.
Read how Software Security for Developers explains software supply-chain attack →
Related concepts
- sandboxingaddressed by · Sandboxing is the isolation of software execution in a restricted environment that limits its access to resources and its effects on surrounding systems.
- dependency managementconfigures · Dependency management is the practice of declaring, resolving, versioning, obtaining, updating, and controlling the software components required by a project.
These guides are generated from the text of Manning books by Manning's knowledge graph and link to the sections they draw on. The full books are available on liveBook and at manning.com.