Software Supply Chain Security.

The discipline of protecting every link of the software production chain - source, dependencies, build, signing, distribution, and deployment - against tampering, malicious code, and integrity loss. It belongs to the Application Security category of cybersecurity.

The discipline of protecting every link of the software production chain - source, dependencies, build, signing, distribution, and deployment - against tampering, malicious code, and integrity loss.

Software supply chain security treats code as something assembled from many sources rather than written from scratch. It covers source repository protection, identity for developers, secure CI/CD, dependency curation, SBOM and CBOM generation, signing and verification (Sigstore, Cosign, in-toto), provenance attestation per SLSA, vulnerability management, secrets handling, and policy enforcement at deployment. The discipline emerged in response to incidents like SolarWinds, Codecov, Log4Shell, XZ Utils, and dependency confusion campaigns. Frameworks and guidance include SLSA, NIST SSDF (SP 800-218), CISA Secure by Design, US EO 14028, and the EU Cyber Resilience Act, all converging on signed, verifiable, transparent pipelines.

Defences for Software Supply Chain Security typically combine technical controls and operational practices, as detailed in the full definition above.

Common alternative names include: Software supply chain, Build supply chain security.