# software security audit Published articles for software security audit. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## Introducing Chainguard's Trust Center DevFeed: [Introducing Chainguard's Trust Center]() Original publisher: [Read original article]() Published: 2024-05-14T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [chainguard](), [Security](), [supply-chain-security](), [chainguard images](), [soc 2]() Tags: [audit](), [certifications](), [chainguard](), [compliance](), [iso-27001](), [nist](), [security](), [slsa](), [soc](), [soc2](), [software-security-audit](), [software-security-best-practices](), [software-supply-chain](), [software-supply-chain-security](), [trust-center]() ### AI overview Chainguard introduces its Trust Center, a platform that centralizes security, compliance, and privacy information for users and customers. The center provides access to independent penetration-testing assessments, a SOC 2 Type 2 audit report, hardening guidance, privacy information, data-subprocessor details, and information security policies. ### Source excerpt Learn how Chainguard prioritizes security with our new Trust Center. Find info on our policies, certifications, and how we protect your software supply chain. ## Chainguard's Trail of Bits security assessment DevFeed: [Chainguard's Trail of Bits security assessment]() Original publisher: [Read original article]() Published: 2024-05-14T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [Security](), [GitHub Actions](), [Code review](), [GitHub](), [Monitoring]() Tags: [chainguard](), [code-review](), [github-actions](), [github-credentials](), [github-pat](), [least-privilege](), [monitoring](), [octo-sts](), [security](), [software-security-audit](), [supply-chain]() ### AI overview Chainguard describes an independent Trail of Bits security assessment of its production environment and supply-chain defenses. The assessment found no critical issues, but identified command injection in a GitHub Action and insufficient redaction of sensitive CloudEvents; Chainguard reports that both issues were fixed. The article also outlines security improvements involving GitHub credentials, GitHub Actions monitoring, FIDO security keys, anomaly monitoring, and production-network alerts. ### Source excerpt Trust but verify: Read about Chainguard's independent security assessment by Trail of Bits and our dedication to transparency in security practices. ## What every CISO should know about the new SSDF security self-attestation form DevFeed: [What every CISO should know about the new SSDF security self-attestation form]() Original publisher: [Read original article]() Published: 2023-08-08T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [supply-chain-security](), [cisa](), [Cybersecurity](), [Security]() Tags: [chainguard-images](), [cisa](), [cve](), [cybersecurity](), [fedramp](), [regulatory](), [secure-software](), [secure-software-development-frameworks](), [self-attestation](), [software-security-audit](), [software-supply-chain-security](), [ssdf](), [standards](), [vulnerability-management]() ### AI overview This joint blog post explains a proposed Secure Software Self-Attestation Form published by CISA and its implications for CISOs. It describes how organizations selling software for government use may need to attest to their best efforts to follow NIST's Secure Software Development Framework, while highlighting related software supply chain security practices and regulatory developments. ### Source excerpt Explore the pivotal SSDF Security Self-Attestation Form, a key resource for CISOs to navigate and enhance security compliance. ## The principle of minimalism DevFeed: [The principle of minimalism]() Original publisher: [Read original article]() Published: 2023-06-22T00:00:00Z Content type: opinion Language: en Sources: [Chainguard: Unchained]() Topics: [Security](), [Access Control](), [Kubernetes](), [Docker](), [systems]() Tags: [access-control](), [docker](), [engineering](), [iam](), [kubernetes](), [kubernetes-security](), [least-privilege](), [secure-by-default](), [security](), [software-security-audit](), [software-security-practices](), [software-supply-chain](), [zero-trust-networking](), [zero-trust-security]() ### AI overview This engineering commentary argues that systems should use secure-by-default minimalism: defaults should expose only what users actually need, while deviations should be intentional and audited. It uses Docker and Kubernetes examples, including root containers, mutable deployment references, and secret handling, and introduces access-control applications such as non-root execution and minimal seccomp profiles. ### Source excerpt Learn about the principle of minimalism in engineering, where your default should be the lowest-common denominator of what you actually need.