CCNA Secure Software Supply Chain Questions

Automated scanning of stored artifacts detects known CVEs in dependencies and images before deployment, blocking compromised components from reaching consumers. This satisfies the supply chain constraint by continuously verifying that registry contents remain free of exploitable vulnerabilities throughout their retention.

A VDP publishes a defined intake route, such as a security contact or bug bounty portal, so external researchers can report findings without resorting to public disclosure. This gives the vendor private remediation time, satisfying the stem's focus on the policy's primary function.

Scoping the registry URL in .npmrc to your internal Artifactory or Nexus ensures npm resolves scoped packages only from the private registry, so a malicious public package with the same name cannot be substituted. This directly prevents the dependency confusion attack described in the stem.

The ':latest' tag is mutable: a registry push can repoint it to a different image digest at any time. Because the build server resolves the tag at pull time, an attacker who compromises the registry or upstream project can substitute a malicious image, executing arbitrary code in the build pipeline.

Cryptographic hashes uniquely identify the exact artifact and enable integrity verification. When a new vulnerability is announced, a hash allows you to confirm whether the specific binary or package you received is affected, rather than relying solely on version numbers which can be ambiguous or spoofed. This supports rapid and accurate response, as you can match the hash against known vulnerable artifacts and ensure you are analyzing the correct code.

Hermetic builds require isolation from external inputs, so disabling network access during the build stops dependency downloads, exfiltration and remote code retrieval. This closes the pipeline compromise vector where an attacker injects malicious content over the network mid-build.

Fourth-party sub-processors are the upstream dependencies where supply chain failures actually originate. Requesting this list exposes concentration risk and unassessed vendors beneath the SaaS provider, directly satisfying the stem's resilience evaluation of the extended supply chain rather than the provider's own controls.

SLSA Level 3 requires the build platform to be hardened against tampering and to generate authenticated provenance, cryptographically signed by the build service. This ensures artefacts trace to a trusted, isolated builder rather than a developer workstation.

Mandating an SBOM for all delivered software gives the policy a concrete, verifiable foundation: it establishes component-level visibility across the supply chain, enabling vulnerability tracking, licence review and provenance checks on third-party and open-source dependencies.

A digital signature, such as Authenticode or GPG, is verified with the signer's public key to confirm the code's integrity and origin authenticity. This satisfies the stem's proof-of-signing requirement, unlike a hash alone, which detects alteration but does not establish who signed.

Snyk Open Source scans dependency manifests against a vulnerability database and fails the GitHub Actions job when high-severity issues are found, gating the build. This satisfies the automated policy requirement by blocking merges rather than merely reporting findings.

A documented tracking and patching process demonstrates repeatable, proactive vulnerability management rather than ad hoc reaction. This satisfies the stem's demand for the strongest indicator, since it evidences an ongoing capability to identify and remediate vulnerable components before exploitation.

An SBOM enumerates every component and version in the software, enabling automated matching against vendor lifecycle data to flag components past their support date. This directly satisfies the stem's supply chain threat: unpatched, unsupported dependencies that no longer receive security fixes, which attackers exploit through known vulnerabilities.

SLSA level 3 requires that provenance be generated by a trusted build platform and that it be signed and stored in a way that prevents tampering by the build system itself. Storing unsigned provenance on the same server allows an attacker who compromises the build server to alter both the artifact and its provenance. This violates the core requirement for non-falsifiable provenance and isolation between the build and provenance storage.

The layout file is the signed root of trust in in-toto; it specifies the ordered supply chain steps, the functionaries authorised to perform each, and the artefacts each step must produce. Verification then checks link metadata against these defined expectations.

A formal component inventory, such as an SBOM, is foundational for regulatory compliance and incident response. It enables traceability when a new vulnerability is disclosed, allowing the organization to quickly determine exposure. FDA guidance emphasizes software bill of materials and component transparency. Without an accurate inventory, even the best scanning tool cannot provide a complete picture of risk or support post-market surveillance obligations.

An allowlist-only proxy permits only explicitly approved package names and versions, so a typosquatted dependency is rejected at resolution time regardless of how similar its name appears. This directly blocks accidental inclusion, satisfying the stem's constraint.

Reviewing SOC 2 and ISO 27001 reports provides independent, standardised assurance over a vendor's controls, satisfying the need for objective evidence rather than self-attestation. This directly addresses the stem's requirement for an essential assessment component, since third-party audits validate security posture against recognised frameworks without relying solely on vendor claims.

The attestation's value depends on the identity of the signer and the build environment it represents. If an internal runner signs on behalf of upstream, the cryptographic guarantee is only that the internal system produced that statement, not that the upstream maintainer did. An attacker who compromises the internal runner can generate a valid signature for a tampered artifact, and downstream verification will still pass.

Fourth-party risk arises from subcontractors and downstream providers the vendor relies on. Maintaining an inventory of critical fourth-party service providers demonstrates visibility and control beyond direct suppliers, satisfying the mature Vendor Risk Management practice of mapping transitive dependencies.