Strategies for the Integration of Software Supply Chain Security in DevSecOps CI/CD Pipelines book cover
Technology · First published February2024 · English

Strategies for the Integration of Software Supply Chain Security in DevSecOps CI/CD Pipelines

by Ramaswamy Chandramouli; Frederick Kautz; Santiago Torres-Arias

Read this book →Download PDF

About this book

Ramaswamy Chandramouli, Frederick Kautz and Santiago Torres-Arias explain how software supply chain protections can be integrated into the pipelines used to build and deploy cloud-native applications. The report follows software from source material through the stages that produce a deployable version.

Its discussion connects continuous integration and continuous deployment with the actors, artifacts and repositories involved in delivering software. Provenance, attestations and software bills of materials provide ways to describe and check what enters a build and what emerges from it. The report relates these mechanisms to the threats and trust relationships of the supply chain.

The strategies are presented within the DevSecOps approach used by teams maintaining applications composed of multiple services. Diagrams and technical explanations connect individual security measures with the operation of an overall pipeline. This is the complete February 2024 NIST publication, preserving its original structure, references and terminology.

Ramaswamy Chandramouli, Frederick Kautz and Santiago Torres-Arias. NIST SP800-204D (2024). https://doi.org/10.6028/NIST.SP.800-204D.