Supply Chain Security 101
Everything you need to know about software supply chain security in the age of open source.
- Tools & Buyer’s GuidesDevSecOps
GitHub Actions alternatives: 8 ways to replace or secure unvetted actions
Compare 8 alternatives to unvetted GitHub Actions, including hardened drop-in replacements, SHA pinning, GitLab, CircleCI, and Buildkite, for secure CI/CD.
- Software Supply ChainDevSecOps
npm supply chain attacks: How to audit your dependency controls
Reduce the risk of npm supply chain attacks. Trace a package’s path into your build, verify its artifact, and control what can execute.
- Software Supply ChainDevSecOps
What is dependency confusion? How to reduce the risk of attack
Dependency confusion tricks a build into installing a malicious public package instead of a private one. Learn the controls that reduce the risk.
- DevSecOpsSoftware Supply Chain
CI/CD security: A practical guide to trusted pipelines
Secure CI/CD pipelines from dependency confusion, tag hijacking, and secret leaks. Learn key controls like pinned actions and build provenance.
- Software Supply ChainDevSecOps
What is container runtime security?
Understanding container runtime security best practices can help protect your critical applications against threats to your containerized applications.
- AppSecDevSecOps
Attack Surface Management (ASM): Best practices guide
Learn what attack surface management is, why it matters, and how to reduce risk with modern tools and best practices.
- Software Supply ChainDevSecOps
Managing risk in the software supply chain
Secure your product by understanding risk factors in complex software supply chains, and best practices for mitigating common security vulnerabilities.
- Software Supply ChainDevSecOps
Security automation: Stop chasing vulnerabilities and start preventing them
Security automation can ensure that vulnerabilities in open source components are resolved quickly and efficiently.
- Software Supply ChainDevSecOps
What is a secure software development lifecycle (SDLC)?
Understand what a secure SDLC is, and how you can integrate secure coding practices into the SDLC to build better applications.
- AppSecDevSecOps
A guide to modern vulnerability scanning
Explore the lifecycle of vulnerability scanning, its importance for security and compliance, and tips to improve outcomes across your org.
- DevSecOpsSoftware Supply Chain
What is Software Composition Analysis (SCA)?
Learn what SCA is and how it works: inventory dependencies, map CVEs and licenses, and enforce policy in PRs and CI before release.
- AppSecDevSecOps
Streamlining the vulnerability management lifecycle
Learn what the vulnerability management lifecycle is, the challenges teams face, and tips to streamline the process for better security outcomes.