Supply Chain Security

Software supply chain, dependency management, SBOM, and vendor risk.

Overview

Supply chain security protects against compromised components.

Attack Vectors

Software Bill of Materials (SBOM)

{
  "bomFormat": "CycloneDX",
  "specVersion": "1.4",
  "components": [
    {
      "type": "library",
      "name": "lodash",
      "version": "4.17.21",
      "licenses": [{"id": "MIT"}]
    }
  ]
}

Dependency Scanning

# npm audit
npm audit
npm audit fix

# Snyk
snyk test
snyk monitor

# OWASP Dependency Check
dependency-check --project "My App" --scan ./src

Secure Development Practices

# Signed commits
git config --global commit.gpgsign true
git config --global user.signingkey ABCDEF1234567890

# Verified builds
build:
  verify_signatures: true
  reproducible_builds: true

Vendor Risk Assessment

Best Practices

1. Verify signatures — Code and packages
2. Pin dependencies — Specific versions
3. Scan dependencies — Regular audits
4. Vendor assessment — Due diligence
5. Monitor for vulnerabilities — Continuous

Practice

Implement SBOM generation and dependency scanning in a CI/CD pipeline.