# The importance of toolchain security in NIST's SSDF

DevFeed: [The importance of toolchain security in NIST's SSDF](<https://devfeed.tech/articles/the-importance-of-toolchain-security-in-nist-s-ssdf-13258.md>)

Original publisher: [Read original article](<https://www.chainguard.dev/unchained/the-importance-of-toolchain-security-in-nists-ssdf>)

Published: 2023-06-12T00:00:00Z

Content type: opinion

Language: en

Sources: [Chainguard: Unchained](<https://devfeed.tech/sources/chainguard-unchained.md>)

Topics: [toolchain](<https://devfeed.tech/topics/toolchain.md>), [Security](<https://devfeed.tech/topics/security.md>), [Architecture & Design](<https://devfeed.tech/topics/architecture-design.md>), [Software Engineering](<https://devfeed.tech/topics/software-engineering.md>)

Tags: [cloud-security](<https://devfeed.tech/tags/cloud-security.md>), [fedramp](<https://devfeed.tech/tags/fedramp.md>), [nist](<https://devfeed.tech/tags/nist.md>), [secure-software](<https://devfeed.tech/tags/secure-software.md>), [security](<https://devfeed.tech/tags/security.md>), [self-attestation](<https://devfeed.tech/tags/self-attestation.md>), [ssdf](<https://devfeed.tech/tags/ssdf.md>), [supply-chain-attacks](<https://devfeed.tech/tags/supply-chain-attacks.md>), [toolchain](<https://devfeed.tech/tags/toolchain.md>)

## AI overview

This article argues that build systems and programming-language toolchains should be secured and inventoried like production systems. It discusses third-party code execution during installation and highlights Go toolchain vulnerabilities that enabled remote code execution during builds.

## Source excerpt

The new Secure Software Development Framework (SSDF) from NIST places toolchain inventory management and security front and center.