Securing Ironwood's software supply chain in both directions, as producer and consumer: a chain of six interlocking links — source, dependencies, build, package, distribute and deploy; above each link the way an attacker injects, from a weak developer account and dependency confusion to a compromised build, a stolen signing key, a poisoned registry and an unverified artifact; and below each link the verification that closes it — protected branches, an SBOM covering forty direct dependencies and more than a thousand transitive ones, hardened CI with SLSA provenance, signed and attested artifacts, verification on every pull and admission control that refuses anything unsigned.

CY-EXPERT-046Expert Level · Supply Chain Security

Supply Chain Security — The Chain of Verified Trust

A twenty-hour, highly interactive expert-level course where you secure the software supply chain link by link — source, dependencies, build, artifacts, distribution, and deployment — knowing what is in your software and verifying integrity and provenance at every link. Trust is transitive; the chain is only as strong as its weakest link. Four hands-on activities in every lesson.

20 hours9 chapters45 lessons295 activities9 labs

What you'll learn

Build an SBOM and inventory, and account for the transitive dependency tree.
Secure dependencies, the source, and the build against supply-chain threats.
Establish and verify provenance through signing, attestations, and admission control.
Respond to supply-chain incidents and run an ongoing, risk-based program.

Price:৳12,000