Skip to content

Added blank space on software supply chain security guidelines #828

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
za wants to merge 1 commit into
base: master
Choose a base branch
from
Open

Added blank space on software supply chain security guidelines #828

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions 2021/docs/en/2025/A03_2025-Software_Supply_Chain_Failures.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -79,8 +79,6 @@ You are likely vulnerable if:

There should be a patch management process in place to:



* Know your Software Bill of Materials (SBOM) of your entire software and manage the SBOM-dictionary centrally.
* Track not just your own dependencies, but their (transitive) dependencies, and so on.
* Remove unused dependencies, unnecessary features, components, files, and documentation. Attack surface reduction.
Expand All @@ -94,6 +92,7 @@ There should be a patch management process in place to:


There should be a change management process or tracking system in place to track changes to:

* Your CI/CD settings (all build tools and pipeline)
* Your code repository
* Sandbox areas
Expand All @@ -106,6 +105,7 @@ There should be a change management process or tracking system in place to track


Harden the following systems, which includes enabling MFA and locking down IAM:

* Your code repository (which includes not checking in secrets, protecting branches, backups)
* Developer workstations (regular patching, MFA, monitoring, and more)
* Your build server & CI/CD (separation of duties, access control, signed builds, environment-scoped secrets, tamper-evident logs, more)
Expand Down