Software supply chain security
Software supply chain security is the protection and verification of software source code, dependencies, build processes, artifacts, and delivery mechanisms against compromise or unauthorized modification.
Data-Driven Cybersecurity
The process of identifying, assessing, monitoring, and mitigating cybersecurity risks arising from supply-chain partners, dependencies, and external providers.
- How it is used
- Extends cybersecurity governance to external partners so vendor risk can inform protective controls and executive decisions.
- How deep it goes
- Details cataloging, prioritization, assessments, contract requirements, monitoring, and metric-based follow-up rather than software implementation internals.
- Examples
- Uses a vendor-access breach and a produce retailer’s compliance, annual-review, and audit dashboard.
- What you can do after
- Practice/perform vendor prioritization and assessment, then compare dashboard results with targets to identify follow-up actions.
Read how Data-Driven Cybersecurity explains software supply chain security →
Effective Platform Engineering
Software supply chain security is the protection of software source code, build processes, dependencies, artifacts, and delivery mechanisms from compromise or unauthorized modification.
- How it is used
- Protects the engineering platform’s path from code creation through build, storage, deployment, and user delivery.
- How deep it goes
- Explains signed commits, audit principles, policy as code, point-of-change automation, and automatically generated provenance.
- Examples
- Uses the SolarWinds compromise, signed commits, executable artifacts, deployment pipelines, and provenance diagrams.
- What you can do after
- Apply it via signed commits, repository policy, supply chain audits, and automated provenance across delivery stages.
Read how Effective Platform Engineering explains software supply chain security →
Related concepts
- policy as codeused by · Policy as code is the practice of expressing organizational, security, authorization, or compliance policies as machine-readable, version-controlled rules that can be tested and enforced automatically.
- compliance at the point of changeused by · Compliance at the point of change verifies compliance through a control mechanism before a software change is made.
- vulnerability scanninguses · Vulnerability scanning is the automated or systematic examination of software, systems, or configurations to identify known security weaknesses.
- complianceuses · Compliance is conformity with applicable legal, regulatory, contractual, policy, or other governing requirements.
- security controluses · A security control is a safeguard, policy, or restriction designed to reduce security risks or enforce security objectives.
- golden imageproduced by · A golden image is an approved, standardized, preconfigured machine or container image used as a reusable deployment baseline.
These guides are generated from the text of Manning books by Manning's knowledge graph and link to the sections they draw on. The full books are available on liveBook and at manning.com.