A software development firm is enhancing its software supply chain risk management following a security incident where a tampered third-party open-source library introduced malicious code into the build pipeline. Which TWO of the following technical controls should the security team implement to verify third-party component integrity and maintain ongoing visibility into software supply chain vulnerabilities? (Select TWO.)
- Require third-party software components to be delivered with a Software Bill of Materials (SBOM) and integrate it into automated vulnerability management systems.Answer
- BDeploy network stateful firewalls around developer workstations to inspect incoming library source code files for embedded backdoors.
- Enforce digital signature and code provenance verification for all imported third-party packages before allowing build pipeline ingestion.Answer
- DRequire third-party software maintainers to sign a Non-Disclosure Agreement (NDA) prior to executing code in the build environment.
- EEstablish a Service Level Agreement (SLA) guaranteeing 99.99% operational availability of external open-source code repositories.
Answer
The organization should mandate a Software Bill of Materials (SBOM) integrated with vulnerability scanners, and enforce digital signature and code provenance verification for all imported third-party software packages.
Implementing a Software Bill of Materials (SBOM) provides complete transparency into all nested software dependencies, enabling automated scanners to identify vulnerable sub-components immediately. Combining SBOM tracking with cryptographic signature and provenance verification guarantees that imported packages stem from authentic authors and were not altered during distribution.
Step-by-Step Solution
Key Concept
Third-Party Software Supply Chain Verification (SBOM and Package Signing)