Software Supply Chain Security

Chapter 11. People in the Software Supply Chain

There is a saying that security is only as good as its weakest link, and as demonstrated in real-life security breaches, in case after case dating back to the earliest hackers, humans are consistently the weakest link. We are the ones making decisions on how the systems are designed, we select or write the code, and we bring it all together to release it to our customers. Until all code and systems are free of vulnerabilities—which will never happen—we must expect imperfection but strive to improve ourselves in the journey to create more secure applications and products.

Throughout the book, there have been many areas where a person’s role in software supply chain security is a factor. Different frameworks such as NIST SSDF, ISA/IEC 62443-4-1 SDL, and NERC CIP provide requirements and controls to lower the risk of compromise. These requirements include training, governance, management, policies, and procedures. Your organization should continuously perform the practices and controls in this chapter—not only once a year or when a new person joins the organization.

According to a 2022 study by ThriveDX, we have seen cybersecurity awareness grow to 97% in companies, but general awareness training is just the start.¹ One way to encourage engagement and adoption of cybersecurity practices is through mandatory cybersecurity training, security champions programs, and internal certifications, as described in this chapter, or external certifications, ...