Look inside

about the book

Securing the Software Supply Chain teaches you everything you need to know to identify and protect the code, data, and infrastructure of your applications. You’ll get a comprehensive breakdown of the kind of threats your software supply chain faces, and how they can be dramatically different from traditional dangers. Learn how to implement a chain of custody throughout your software development lifecycle, with techniques ranging from securing developer workstations to implementing dependency proxies.

Real-world examples from a financial services company illustrate each concept, including key signing ceremonies, establishing trust roots, and generating a Software Bill of Materials (SBOM)—vital documentation for supply chain risk management.

about the reader

For software senior engineers and architects with experience in DevSecOps.

about the authors

Michael Lieberman is CTO and co-founder of Kusari, a cybersecurity startup focused on software supply chain security. Michael has previously worked in the financial industry, architecting cloud migrations with a focus on security. In addition, he is an OpenSSF TAC member; a member of the SLSA steering committee, an emerging supply chain security standard; as well as a CNCF Security TAG lead.

Brandon Lum is a co-chair of the CNCF Security TAG, and as a part of Google’s Open Source Security Team, he works on improving the security of the Open Source ecosystem. Previously at IBM Research, Brandon worked on various security areas, such as container content protection via encryption and image signing, identity, Zero Trust architectures, and kernel attack surface reduction.