CISA, NSA, and ODNI share tips to secure the software supply chain

guest · Sep 3, 2022

By Sergiu Gatlan @serghei - September 1, 2022

The U.S. National Security Agency (NSA) and the Cybersecurity and Infrastructure Security Agency (CISA) have released tips today on securing the software supply chain.
Click to expand...

This guidance is designed by the Enduring Security Framework (ESF)—a public-private partnership that works to address threats to U.S. critical infrastructure and national security systems—to serve as a collection of suggested practices for software developers.

"Securing the Software Supply Chain for Developers was created to help developers achieve security through industry and government-evaluated recommendations," the Department of Defense's intelligence agency said.

"Developers will find helpful guidance from NSA and partners on developing secure code, verifying third party components, hardening the build environment, and delivering the code. Until all DevOps are DevSecOps, the software development lifecycle will be at risk."
Click to expand...

The ESF will release two more advisories coinciding with the software supply chain lifecycle, with the other two parts in this series focusing on software suppliers and customers.
Click to expand...

NSA: NSA, CISA, ODNI Release Software Supply Chain Guidance for Developers

The National Security Agency (NSA), Cybersecurity and Infrastructure Security Agency (CISA), and the Office of the Director of National Intelligence (ODNI) released Securing the Software Supply Chain for Developers today. The product is through the Enduring Security Framework (ESF) — a public-private cross-sector working group led by NSA and CISA that provides cybersecurity guidance addressing high priority threats to the nation’s critical infrastructure.
Click to expand...

guest · Sep 2, 2022

CISA, NSA, and ODNI Release Part One of Guidance on Securing the Software Supply Chain
September 2, 2022

CISA, the National Security Agency (NSA), and the Office of the Director of National Intelligence (ODNI), have published part one of a three-part joint publication series, Securing Software Supply Chain Series - Recommended Practices for Developers. This guidance—created by the Enduring Security Framework (ESF), a public-private cross-sector working group led by the NSA and CISA—focuses on software developers and provides suggested practices to ensure a more secure software supply chain.

CISA encourages acquiring organizations, software suppliers, and network operators to review the guidance and consider the recommendations. See CISA’s ICT Supply Chain Risk Management Task Force, ICT Supply Chain Resource Library, National Risk Management Center (NRMC) webpages for more information.
Click to expand...

guest · Nov 17, 2022

CISA, NSA, and ODNI Release Guidance for Customers on Securing the Software Supply Chain
Original release date: November 14, 2022 | Last revised: November 17, 2022

Today, CISA, the National Security Agency (NSA), and the Office of the Director of National Intelligence (ODNI), published the third of a three-part series on securing the software supply chain: Securing Software Supply Chain Series - Recommended Practices Guide for Customers. This publication follows the August 2022 release of guidance for developers and October 2022 release of guidance for suppliers.
Click to expand...

The guidance released today, along with its accompanying fact sheet, provides recommended practices for software customers to ensure the integrity and security of software during the procuring and deployment phases.

The Securing Software Supply Chain Series is an output of the Enduring Security Framework (ESF), a public-private cross-sector working group led by NSA and CISA. This series complements other U.S. government efforts underway to help the software ecosystem secure the supply chain, such as the software bill of materials (SBOM) community.
Click to expand...

CISA encourages all organizations that participate in the software supply chain to review the guidance. See CISA’s Information and Communications Technology (ICT) Supply Chain Risk Management Task Force, ICT Supply Chain Resource Library, and National Risk Management Center (NRMC) webpages for additional guidance.
Click to expand...

Log in or Sign up

CISA, NSA, and ODNI share tips to secure the software supply chain

guest Guest

guest Guest

guest Guest

Log in or Sign up

CISA, NSA, and ODNI share tips to secure the software supply chain

guest Guest

guest Guest

guest Guest

Useful Searches