Your organization develops software involved in many open source projects and is concerned about software supply chain threats. You need to deliver provenance for the build to demonstrate the software is untampered.
What should you do?
A.
1. Hire an external auditor to review and provide provenance. 2. Define the scope and conditions. 3. Get support from the Security department or representative. 4. Publish the attestation to your public web page.
B.
1. Review the software process. 2. Generate private and public key pairs and use Pretty Good Privacy (PGP) protocols to sign the output software artifacts together with a file containing the address of your enterprise and point of contact. 3. Publish the PGP signed attestation to your public web page.
C.
1. Publish the software code on GitHub as open source. 2. Establish a bug bounty program, and encourage the open source community to review, report, and fix the vulnerabilities.
D.
1. Generate Supply Chain Levels for Software Artifacts (SLSA) level 3 assurance by using Cloud Build. 2. View the build provenance in the Security insights side panel within the Google Cloud console.
The best option would be D. Generate Supply Chain Levels for Software Artifacts (SLSA) level 3 assurance by using Cloud Build and view the build provenance in the Security insights side panel within the Google Cloud console.
SLSA (pronounced “salsa”) is an end-to-end framework for ensuring the integrity of software artifacts throughout the software supply chain. The SLSA assurance levels provide a scalable compromise between the security benefits and the implementation costs. Level 3 is recommended for moderately to highly critical software and should provide strong, provenance-based security guarantees.
A voting comment increases the vote count for the chosen answer by one.
Upvoting a comment with a selected answer will also increase the vote count towards that answer by one.
So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.
wojtek85
Highly Voted 1 year, 2 months agoi_am_robot
Most Recent 10 months, 3 weeks agocyberpunk21
1 year, 2 months agoakg001
1 year, 2 months agoSanjana2020
1 year, 3 months ago