Know what enters the product
Record direct and transitive dependencies, build tools, base images, external services and third-party code. Capture version, source, licence, maintenance status and where each component is used. An inventory is useful only when it connects a vulnerable component to deployed products and accountable owners.
Define approved sources and review new high-impact dependencies for maintenance, security history, ownership and alternatives. A popular package is not automatically trustworthy. Minimise unnecessary components because every dependency creates update, provenance and response work.
Protect source and build integrity
Restrict changes to repositories, pipeline definitions and release credentials. Require review for sensitive components and protect branches and tags. Isolate builds from untrusted input, verify downloaded artefacts and prevent secrets from entering code, logs or packages.
Produce traceable releases that connect source revision, dependency set, build environment and security checks. Signing can support integrity when keys and verification are properly managed; it does not prove that the signed software is free of vulnerabilities or malicious design.
Prepare coordinated vulnerability response
Define how component advisories are received, assessed and connected to deployed services. Maintain supplier contacts and a route to update, isolate or replace a component. Test whether the organisation can identify affected versions quickly.
When an issue occurs, preserve evidence and communicate scope, mitigation and uncertainty. After remediation, examine why the component or build path created exposure and improve selection, monitoring or architecture. Measure coverage and response time rather than the number of dependency alerts.
What to do next.
- ✓Inventory dependencies, images, tools and external services.
- ✓Use approved sources and review important new components.
- ✓Protect repositories, pipelines and signing keys.
- ✓Create traceable, integrity-checked releases.
- ✓Connect advisories to deployed products and owners.
- ✓Test component identification and replacement.
Use guidance responsibly
Technology, provider behaviour and legal requirements change. Validate implementation details against current official documentation, test changes safely and obtain qualified legal advice where required.
Liam Khumalo
Secure Systems ContributorCovers software, SaaS and infrastructure design with an emphasis on maintainable controls, ownership and safe change.
More from this writer