SOFTWARE SUPPLY CHAIN SECURITY: A Practical Guide to SBOMs, SLSA Provenance, and EU Cyber Resilience Act Compliance For DevSecOps, Platform Engineering, and Application Security Teams - Softcover

SOFTWARE SUPPLY CHAIN SECURITY : A Practical Guide to SBOMs, SLSA Provenance, and EU Cyber Resilience Act Compliance For DevSecOps, Platform Engineering, and Application Security Teams

Taschenbuch. Zustand: Neu. Neuware - Your software ships hundreds of dependencies you didn't write, can't see, and can't prove are safe. In 2026, that stopped being optional to fix.If you build, ship, or secure software for a living, you already know the old question, 'is my code secure ', isn't the one regulators, customers, or attackers are asking anymore. The real question is: can you prove what's in your software, where it came from, and that nothing tampered with it along the way Most teams can't answer that. This book makes sure you can.Software Supply Chain Security is the no-fluff, hands-on guide to SBOMs, SLSA provenance, and the compliance deadlines bearing down on every engineering org shipping software into the EU or to the U.S. federal government, written for people who have to actually build this, not just talk about it in a steering committee.Inside, you'll build: - Real, automated SBOM pipelines, not theory, using Syft, Trivy, and native ecosystem tools wired into actual GitHub Actions workflows- SLSA provenance and build attestation, so you can cryptographically prove an artifact came from your pipeline and nothing else- A CRA-ready compliance scope matrix that turns 'are we compliant ' into a prioritized, dated roadmap your leadership can actually act on- A vulnerability and license-gating workflow that catches problems before they ship, not after an auditor finds them- A dated, phased rollout plan (Appendix F) mapping every technical build-out to the real CRA deadlines, 2026 and 2027Why this book now: The numbers are no longer abstract. Third-party involvement in breaches nearly doubled in a single year. The EU Cyber Resilience Act now carries mandatory 24-hour incident reporting. U.S. federal procurement already requires SBOMs for every vendor. The organizations that figure this out now will spend the next three years selling into regulated markets without friction. The ones that don't will spend it explaining to auditors, customers, and boards why they can't.This isn't a compliance book dressed up with engineering buzzwords, and it isn't a developer book that waves at regulation in one chapter and moves on. It's both, built by someone who's done the work, every pipeline, every policy, every template in this book is something you can put into production this week, not someday.Who this is for: DevSecOps engineers, platform and infrastructure teams, application security leads, compliance and GRC professionals, and engineering managers who need their organization audit-ready before the deadlines hit, not after.Stop guessing whether you're compliant. Start proving it.Scroll up and get your copy today. Artikel-Nr. 9798164187187

Verkäufer kontaktieren