A supply-chain attack compromises software, infrastructure, or dependencies through a provider, maintainer, distribution channel, or development process.
A software supply-chain attack inserts malicious code into vendor software, which reaches customers through a distribution channel and compromises their data or systems. Open-source code can be inspected before adoption, but inspection must be paired with security and compliance controls. section 13.1.2
Reduce exposure before adopting an infrastructure module or tool:
Scan the code and review every resource for sensitive outputs, unauthorized third-party communication, and unexpected data collection. section 13.1.2
Deploy the module in an isolated testing environment, then run existing security and compliance tests before approving it for use. section 13.1.2
Assess maintainers, licensing, functionality, and lifecycle alongside static analysis and organizational review. section 13.5section 13.1.2
Figure 13.3 Decision flow for assessing usage of module or tool based on security
Use the decision flow to determine whether a module or tool is secure enough for organizational adoption. section 13.1.2
How Infrastructure as Code, Patterns and Practices: With examples in Python and Terraform covers it
How deep it goes
Defines the attack and gives a practical screening, isolation, testing, and approval workflow, while acknowledging that risk assessment is simplified.
Examples
Uses leaked passwords during dry runs, unauthorized HTTP endpoints, isolated module deployments, and security and compliance tests.
What it assumes
Assumes infrastructure resources and security and compliance tests already exist, while treating open-source inspection as an available safeguard.
What you can do after
Evaluate and approve infrastructure modules or tools through code review, isolated testing, scanning, and security and compliance verification.
How it connects
Connects software supply-chain attacks with open source, infrastructure as code, security testing, static code analysis, and third-party data collection.
Software Security for DevelopersA security attack that compromises software components, providers, or delivery processes to affect downstream applications.
sandboxingaddressed by · Sandboxing is the isolation of software execution in a restricted environment that limits its access to resources and its effects on surrounding systems.
dependency managementconfigures · Dependency management is the practice of declaring, resolving, versioning, obtaining, updating, and controlling the software components required by a project.
This explainer was generated by Manning's knowledge graph from the text of Infrastructure as Code, Patterns and Practices: With examples in Python and Terraform. The section links point to the parts of the book it draws on.
