thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Application & OT Security · Intermediate

Software Supply Chain Security

Protecting the integrity, provenance and security of all code, dependencies, tools and processes used to build and deliver software.

Definition

It covers open-source and third-party components, source repositories, build systems, artifact repositories and distribution channels. Frameworks include SLSA, NIST SSDF, OpenSSF guidance and SBOM requirements. High-profile incidents include SolarWinds, Codecov, 3CX and the XZ Utils backdoor.

Example

Requiring signed commits, isolated builds, signed artifacts with provenance and an SBOM for each release.

Exam tip

Covers both vulnerable dependencies and deliberate compromises of the build pipeline.

Related terms