دانلود کتاب امنیت زنجیره تأمین نرم‌افزار – ایمن‌سازی زنجیره تأمین سرتاسری برای نرم‌افزار، میان‌افزار و سخت‌افزار

Software is everywhere. Trillions of lines of source code are running every part of our lives. A single software vulnerability or ransomware attack can stop entire companies from doing business and cause billions of dollars in revenue loss and business recovery. Now, more than ever, we need to ensure that our software, firmware, and hardware are secure to keep our world up and running, safely and securely. Malware, security vulnerabilities, application security, and product security are not new to the software industry, but now these topics have reached mainstream news because of the effects they have on everyone. My part in this became very real when I was visiting my family on the US East Coast the week of the Colonial Pipeline attack.1 I spent two hours waiting in line at the sole gas station within 20 miles that had gas, and then the rest of that afternoon explaining to my family about business continuity and supply chain attacks. Supply chains are critical to our lives. According to Investopedia, “a supply chain is a network of individuals and companies who are involved in creating a product and delivering it to the consumer.”2 The same is true for software. Software usually is developed by multiple individuals, who are often part of multiple organizations or companies. Over time, thousands of developers may have code inside of a single application. For example, I wrote code for ZSoft’s paint.exe, which was sold to Microsoft in the 1980s. I’m certain there are lines of my code still in existence within MS Paint on the Microsoft Windows platform. Nearly 40 years later, an untold number of developers have also contributed their talents to the small, but useful, application. Ensuring software security within the supply chain is difficult, usually due to the longevity of code that was written before secure development and secure design practices were in place. Combined with the ever-increasing threat actors who are constantly discovering new ways to exploit code and systems, it will always be difficult to guarantee a product or application’s security, but that should not prevent us from doing our absolute best to secure the software supply chain. Despite the complicated nature of the software supply chain, it is our duty as software producers to establish secure supply chains and provide information to our consumers. As consumers, we should use this information to address the risks that the supply chain might present to our own organizations. The effort to improve a company’s software supply chain is not small. And it’s not only a software development process problem: software supply chain security requires all parties in the supply chain to participate in order to improve the security posture of software, firmware, and hardware. In this book, I will show you how to implement a software supply chain security program in an organization of any size, but especially for small companies that don’t have dedicated application or supply chain security experts. I will explain why each security control exists, without someone needing a computer science or cybersecurity degree to understand the security risks and the reasons for the controls. This book is not intended to be an all-encompassing set of controls. You can remove any controls that are not applicable and add the controls you need to the controls framework you already have in place. I have included hundreds of references for those needing to follow mandated frameworks, standards, laws, or regulations. However, I must caution you to not limit yourself to those frameworks. You should always be extending and adapting your controls to meet the current gaps and risks within your organization. This book is for anyone who has been tasked with the security of third parties, the supply chain, the purchase of products and applications for their organization, open source software, or software developed within their organization. You may or may not have “security” in your title. Anyone entrusted with the selection, production, and operation of software can use this book to understand the risks in the software supply chain and to implement controls and frameworks. The book doesn’t require a cybersecurity background, though some areas will be technical in explanation, with many references to encourage further learning. I’ve created this practical reference to be understood by business and technology leaders, as well as those in the legal, procurement, insurance, and supply chain organizations. This book is also for security program leaders, whether in the role of CISO (chief information security officer), CPSO (chief product security officer), CSO (chief security officer), GRC (governance, risk, and compliance), application security, or product security.