Supply Chain Security

Noun · Security & Infosec

Definitions

  1. Protecting the integrity of software by securing every component in the supply chain — source code, build systems, dependencies, CI/CD pipelines, and artifact registries. High-profile attacks (SolarWinds, Codecov, ua-parser-js) showed that compromising a single dependency can breach thousands of downstream users. SLSA framework and Sigstore provide defenses.

    In plain English: Protecting your software from attacks that target the tools, libraries, and build systems you depend on.

    Example: "After the SolarWinds attack, we adopted SLSA Level 3 — reproducible builds, signed artifacts, and dependency pinning with hash verification."

Related Terms