A software development firm is enhancing its software supply chain risk management following a security incident where a tampered third-party open-source library introduced malicious code into the build pipeline. Which TWO of the following technical controls should the security team implement to verify third-party component integrity and maintain ongoing visibility into software supply chain vulnerabilities? (Select TWO.)
- Require third-party software components to be delivered with a Software Bill of Materials (SBOM) and integrate it into automated vulnerability management systems.Cevap
- BDeploy network stateful firewalls around developer workstations to inspect incoming library source code files for embedded backdoors.
- Enforce digital signature and code provenance verification for all imported third-party packages before allowing build pipeline ingestion.Cevap
- DRequire third-party software maintainers to sign a Non-Disclosure Agreement (NDA) prior to executing code in the build environment.
- EEstablish a Service Level Agreement (SLA) guaranteeing 99.99% operational availability of external open-source code repositories.
Cevap
The organization should mandate a Software Bill of Materials (SBOM) integrated with vulnerability scanners, and enforce digital signature and code provenance verification for all imported third-party software packages.
Implementing a Software Bill of Materials (SBOM) provides complete transparency into all nested software dependencies, enabling automated scanners to identify vulnerable sub-components immediately. Combining SBOM tracking with cryptographic signature and provenance verification guarantees that imported packages stem from authentic authors and were not altered during distribution.
Adım Adım Çözüm
Anahtar Kavram
Third-Party Software Supply Chain Verification (SBOM and Package Signing)