Software Supply Chain Security Foundations: From Components to Trusted Releases
About this course
This intermediate course teaches developers, engineering leaders, platform teams, security practitioners, and software buyers how to reason about the path from source component to deployed software. Learners identify the trust boundaries in that path, build an inventory that supports decisions, protect build and release systems, evaluate evidence such as provenance, and respond when a dependency or supplier risk changes.
The course is tool- and ecosystem-neutral. It does not promise that a software bill of materials, signature, or scanner makes software safe by itself. Instead, it shows how each control contributes evidence, where it can fail, and how to sequence improvements that engineering teams can operate.
What you'll learn
- ✓ Map a software supply chain and identify the source, dependency, build, release, supplier, and deployment trust boundaries that require evidence.
- ✓ Select proportionate controls for component inventory, dependency acquisition, build integrity, secret handling, and release authorization.
- ✓ Interpret an SBOM, provenance record, signature, policy result, and vulnerability finding without overstating what each proves.
- ✓ Create a response and improvement plan that links a supply-chain risk scenario to accountable actions, verification evidence, and review dates.
Before you begin
You will get more from this course if these foundations are already familiar.
- Basic software delivery knowledge — Learners should understand source control, dependencies, builds, testing, deployment, and the difference between an application and a reusable software component.
Course content
Module 1: 1. Map the Chain and Know What You Use
Establish the threat model and inventory practices that turn software supply-chain security from a vague concern into decisions about real components and trust boundaries.
Software Supply Chain Threat Modeling
Identify where untrusted code, identity, configuration, artifacts, and supplier decisions enter the software delivery path.
Component Inventory and SBOM Decisions
Use component inventory and SBOMs to answer practical questions about ownership, exposure, vulnerability impact, and supplier communication.
Module 2: 2. Protect Builds, Secrets, and Releases
Reduce the risk that a trusted source becomes an untrusted artifact by protecting build definitions, runner environments, identities, secrets, provenance, and release authorization.
Build Integrity and Provenance
Understand how isolated builds, controlled inputs, and provenance evidence make artifact trust more inspectable without promising certainty.
Release Secrets and High-Impact Identities
Limit, protect, rotate, and monitor the credentials that can publish software, alter build pipelines, sign releases, or deploy to production.
Module 3: 3. Operate, Respond, and Improve
Establish the supplier, vulnerability-response, and improvement practices that keep software supply-chain controls useful after a release has shipped.
Vulnerability and Supplier Response
Prepare to assess a vulnerable component or supplier concern quickly by defining ownership, evidence, decision thresholds, and communication paths in advance.
Build a Software Supply Chain Improvement Plan
Turn a release-path assessment into a practical roadmap with risk scenarios, owners, dependencies, measurable evidence, and review points.
Module 4: Secure Development Environments and Software Acquisition
Reduce risk before a build begins by protecting contribution environments and making informed choices about software and services.
Secure Developer Environments and Source Control
Protect development environments and preserve a reviewable, revocable path from proposed source changes to acceptance.
Evaluate Software and Services Before Adoption
Evaluate software, services, tools, and components as ongoing dependencies using staged evidence and explicit conditions.