The National Security Agency (NSA), Cybersecurity and Infrastructure Security Agency (CISA), and the Office of the Director of National Intelligence (ODNI) released Securing the Software Supply Chain for Developers. After examining the events that led up to the SolarWinds attack, it was clear that investment was needed in creating a set of best practices that focused on the needs of the software developer. Securing the Software Supply Chain for Developers was created to help developers achieve security through industry and government-evaluated recommendations. This guidance consolidates valuable resources already published for developers to put to use. CISA’s announcement calls it part one of a three-part series from the Enduring Security Framework, with the parts for software suppliers and customers still to come. Chris Hughes’ walkthrough for CSO Online covers the highlights, from hardened build environments and signed releases to SBOMs and the guide’s crosswalks to NIST’s SSDF and the SLSA levels.
NSA released a guide on Securing the Software Supply Chain
··1 min