FREE COURSE / SELF-PACED LEARNING

Software Supply Chain Security Foundations: From Components to Trusted Releases

Study dependencies, SBOMs, build integrity, provenance, release decisions and response in this free supply-chain security course.

Read the first lesson Explore the curriculum

Read freely. Create an account to save your completed lessons.

Experience level
Intermediate
Curriculum
4 modules · 8 lessons
Estimated reading
32 min
Language
English

Reading estimates use lesson text and an allowance for diagrams. Reflection, exercises and optional linked resources take additional time. These are estimates, not measured completion times.

KNOW WHAT YOU’RE WORKING TOWARD

What you’ll learn

  • Map a software supply chain and identify the source, dependency, build, release, supplier, and deployment trust boundaries that require evidence.
  • Select proportionate controls for component inventory, dependency acquisition, build integrity, secret handling, and release authorization.
  • Interpret an SBOM, provenance record, signature, policy result, and vulnerability finding without overstating what each proves.
  • Create a response and improvement plan that links a supply-chain risk scenario to accountable actions, verification evidence, and review dates.

Is this the right course for you?

Who it’s for

Security and software practitioners developing a foundation in supply-chain risk and controls.

Scope and boundaries

Trust boundaries and control selection across software delivery. The detection-reasoning follow-on concentrates on interpreting telemetry and claims.

How you’ll learn

Self-paced reading with explanatory diagrams and linked resources. Reflection and optional resource study take additional time.

Before you begin

  • Basic software delivery knowledge — Learners should understand source control, dependencies, builds, testing, deployment, and the difference between an application and a reusable software component.

About this course

This intermediate course teaches developers, engineering leaders, platform teams, security practitioners, and software buyers how to reason about the path from source component to deployed software. Learners identify the trust boundaries in that path, build an inventory that supports decisions, protect build and release systems, evaluate evidence such as provenance, and respond when a dependency or supplier risk changes.

The course is tool- and ecosystem-neutral. It does not promise that a software bill of materials, signature, or scanner makes software safe by itself. Instead, it shows how each control contributes evidence, where it can fail, and how to sequence improvements that engineering teams can operate.

FOLLOW THE LEARNING PATH

Course curriculum

MODULE 1

1. Map the Chain and Know What You Use

Establish the threat model and inventory practices that turn software supply-chain security from a vague concern into decisions about real components and trust boundaries.

  1. Software Supply Chain Threat ModelingIdentify where untrusted code, identity, configuration, artifacts, and supplier decisions enter the software delivery path.4 min reading
  2. Component Inventory and SBOM DecisionsUse component inventory and SBOMs to answer practical questions about ownership, exposure, vulnerability impact, and supplier communication.4 min reading

MODULE 2

2. Protect Builds, Secrets, and Releases

Reduce the risk that a trusted source becomes an untrusted artifact by protecting build definitions, runner environments, identities, secrets, provenance, and release authorization.

  1. Build Integrity and ProvenanceUnderstand how isolated builds, controlled inputs, and provenance evidence make artifact trust more inspectable without promising certainty.4 min reading
  2. Release Secrets and High-Impact IdentitiesLimit, protect, rotate, and monitor the credentials that can publish software, alter build pipelines, sign releases, or deploy to production.4 min reading

MODULE 3

3. Operate, Respond, and Improve

Establish the supplier, vulnerability-response, and improvement practices that keep software supply-chain controls useful after a release has shipped.

  1. Vulnerability and Supplier ResponsePrepare to assess a vulnerable component or supplier concern quickly by defining ownership, evidence, decision thresholds, and communication paths in advance.4 min reading
  2. Build a Software Supply Chain Improvement PlanTurn a release-path assessment into a practical roadmap with risk scenarios, owners, dependencies, measurable evidence, and review points.4 min reading

MODULE 4

Secure Development Environments and Software Acquisition

Reduce risk before a build begins by protecting contribution environments and making informed choices about software and services.

  1. Secure Developer Environments and Source ControlProtect development environments and preserve a reviewable, revocable path from proposed source changes to acceptance.4 min reading
  2. Evaluate Software and Services Before AdoptionEvaluate software, services, tools, and components as ongoing dependencies using staged evidence and explicit conditions.4 min reading

BUILD ON THE RIGHT FOUNDATION

These courses address different scopes. Choose the foundation or follow-on that fits your next question.

Advanced

Software Supply Chain Detection Reasoning

Detection evidence across source, build and runtime. For component controls and secure release foundations, start with Software Supply Chain Security Foundations.

3 lessons · 9 min estimated reading

Sources and editorial review

Reviewed by Threat Intelligence Lab

Sources linked in the lessons provide context and further reading. Check the original documentation for current platform behavior and requirements.

Selected references are shown here; the lessons contain the full reading lists.

About this learning content: Courses, lessons, assessments, explanations and illustrations may be created with the help of artificial intelligence. We review and check the material and do our best to avoid incorrect or outdated information, but mistakes, omissions or ambiguous questions may remain. Please verify information before relying on it for professional, security, legal or operational decisions. Read the full notice or report an issue.