Software Supply Chain Security: Protecting the Path From Commit to Production

A guide to enterprise GitLab rollouts comparing GitLab.com, Dedicated, and self-managed models, with planning guidance for runners, availability, disaster recovery, and pipeline performance at scale.

Borg argues the security-review queue blocking releases is a capacity problem: scanners cover known-bad patterns, so reserve humans for judgement calls like intended authorization boundaries.

Developers simply want to write code without interruption, while operations wish to build as fast as possible and deploy without restrictions. On the other hand, security professionals want to protect every step of the software supply chain from any potential security threats and vulnerabilities. In software development, every piece of code can potentially introduce vulnerabilities…

A GrammaTech guest post argues DevSecOps pipelines alone miss the adversarial view; pairing SAST automation with offensive security closes the blind spot where design and code flaws slip through.

Take these four steps to improve your software supply chain security, including enforcing security awareness training, enacting policy and standards adherence, and more.

NetSPI recap of Black Hat 2021 and DEF CON 29: CISA's new Joint Cyber Defense Collaborative, warnings about escalating software supply chain attacks, and a notably thinner hybrid-event crowd.