Trillions of lines of code help us in our lives, companies, and organizations. But just a single software cybersecurity vulnerability can stop entire companies from doing business and cause billions of dollars in revenue loss and business recovery. Securing the creation and deployment of software, also known as software supply chain security, goes well beyond the software development process.

This practical book gives you a comprehensive look at security risks and identifies the practical controls you need to incorporate into your end-to-end software supply chain. Author Cassie Crossley demonstrates how and why everyone involved in the supply chain needs to participate if your organization is to improve the security posture of its software, firmware, and hardware.

With this book, you'll learn how to:

• Pinpoint the cybersecurity risks in each part of your organization's software supply chain
• Identify the roles that participate in the supply chain—including IT, development, operations, manufacturing, and procurement
• Design initiatives and controls for each part of the supply chain using existing frameworks and references
• Implement secure development lifecycle, source code security, software build management, and software transparency practices
• Evaluate third-party risk in your supply chain

From the Preface

In this book, I will show you how to implement a software supply chain security program in an organization of any size, but especially for small companies that don’t have dedicated application or supply chain security experts. I will explain why each security control exists, without someone needing a computer science or cybersecurity degree to understand the security risks and the reasons for the controls.

This book is not intended to be an all-encompassing set of controls. You can remove any controls that are not applicable and add the controls you need to the controls framework you already have in place. I have included hundreds of references for those needing to follow mandated frameworks, standards, laws, or regulations. However, I must caution you to not limit yourself to those frameworks. You should always be extending and adapting your controls to meet the current gaps and risks within your organization.

Who Should Read This Book

This book is for anyone who has been tasked with the security of third parties, the supply chain, the purchase of products and applications for their organization, open source software, or software developed within their organization. You may or may not have “security” in your title. Anyone entrusted with the selection, production, and operation of software can use this book to understand the risks in the software supply chain and to implement controls and frameworks. The book doesn’t require a cybersecurity background, though some areas will be technical in explanation, with many references to encourage further learning.

I’ve created this practical reference to be understood by business and technology leaders, as well as those in the legal, procurement, insurance, and supply chain organizations. This book is also for security program leaders, whether in the role of CISO (chief information security officer), CPSO (chief product security officer), CSO (chief security officer), GRC (governance, risk, and compliance), application security, or product security.

Review

"In the last few years, industry has woken up to the need for software transparency. This book does an excellent job on summarizing the current landscape, and providing context for those trying to improve best practices for managing risk."

-- Kate Stewart

Vice President of Dependable Embedded Systems, The Linux Foundation

"During a time of ever increasing threats to our systems, this book serves as a practical guide for any organization looking to include Software Supply Chain Security as part of their risk management program."

-- Grant Schneider

Former US Federal Chief Information Security Officer

"Cassie has been a pioneer in advocating for and advancing SBOM, particularly in critical infrastructure. This volume is a critical contribution that underscores the need for software transaprency, and highlights paths to implementation."

-- Dr. Allan Friedman

SBOM Champion

"Cassie's book is the most thorough, practical, organized, and actionable supply chain advice I've ever received. Via frameworks and detailed plans this book lays out exactly what to do to ensure your entire product supply chain (physical or digital) is reliably secure."

-- Tanya Janca (SheHacksPurple)

Head of Community and Education; author of Bob and Alice Learn Application Security

"Cassie brings a wealth of knowledge to the topic in this book, covering relevant attack vectors, emerging frameworks, vulnerability disclosures, products, open source, third-party suppliers and navigating the complex human element, all too often overlooked in software supply chain security."

-- Chris Hughes

President & Co-Founder, Aquia; Cyber Innovation Fellow (CIF) at CISA; co-author of Software Transparency: Supply Chain Security in an Era of a Software-Driven Society

About the Author

Cassie Crossley is an experienced cybersecurity technology executive in Information Technology and Product Development. She has many years of business and technical leadership experience in secure software supply chain, cybersecurity, product/application security, software/firmware development, program management, and data privacy. Cassie has designed frameworks and operating models for end-to-end security in software development lifecycles, third-party risk management, cybersecurity governance, and cybersecurity initiatives. She is a member of the CISA SBOM working groups and presents frequently on the topic of SBOMs and Software Supply Chain Security.

Cassie has held positions at Schneider Electric, Ceridian, Hewlett-Packard, McAfee, Lotus, and IBM. She has an M.B.A. from California State University, Fresno, and her Bachelor of Science degree in Technical and Professional Communication with a specialization in Computer Science from Southern Polytechnic State University (now consolidated into Kennesaw State University).