# ssdf Published articles for ssdf. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## No CVEs, No Surprises: Chainguard and the UK Software Security Code of Practice DevFeed: [No CVEs, No Surprises: Chainguard and the UK Software Security Code of Practice]() Original publisher: [Read original article]() Published: 2025-06-09T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [Security](), [chainguard](), [chainguard containers](), [supply-chain-security](), [sdlc](), [Development](), [Cloud Native Ecosystem](), [Resilience](), [sigstore](), [Deployment]() Tags: [chainguard](), [chainguard-containers](), [compliance](), [cyber-resilience-act](), [emea](), [resilience](), [security](), [sigstore](), [slsa](), [software-development](), [software-supply-chain](), [sscop](), [ssdf](), [testing](), [uk](), [united-kingdom](), [zero-cves]() ### AI overview The article explains the United Kingdom's Software Security Code of Practice and maps its 14 principles across secure development, build integrity, deployment, and customer communication. It presents Chainguard Containers, provenance attestations, and signed SBOMs as ways Chainguard supports secure-by-default software and compliance efforts. ### Source excerpt Chainguard Containers support compliance with the United Kingdom's Software Security Code of Practice. Check out what the framework entails and how we help. ## What every CISO should know about the new SSDF security self-attestation form DevFeed: [What every CISO should know about the new SSDF security self-attestation form]() Original publisher: [Read original article]() Published: 2023-08-08T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [supply-chain-security](), [cisa](), [Cybersecurity](), [Security]() Tags: [chainguard-images](), [cisa](), [cve](), [cybersecurity](), [fedramp](), [regulatory](), [secure-software](), [secure-software-development-frameworks](), [self-attestation](), [software-security-audit](), [software-supply-chain-security](), [ssdf](), [standards](), [vulnerability-management]() ### AI overview This joint blog post explains a proposed Secure Software Self-Attestation Form published by CISA and its implications for CISOs. It describes how organizations selling software for government use may need to attest to their best efforts to follow NIST's Secure Software Development Framework, while highlighting related software supply chain security practices and regulatory developments. ### Source excerpt Explore the pivotal SSDF Security Self-Attestation Form, a key resource for CISOs to navigate and enhance security compliance. ## Strengthening CI/CD Environments: Insights from NSA and DHS CISA guidance DevFeed: [Strengthening CI/CD Environments: Insights from NSA and DHS CISA guidance]() Original publisher: [Read original article]() Published: 2023-06-30T00:00:00Z Content type: opinion Language: en Sources: [Chainguard: Unchained]() Topics: [CI/CD](), [supply-chain-security](), [DevSecOps](), [Cybersecurity](), [cisa]() Tags: [chainguard-images](), [ci-cd](), [cicd](), [cisa](), [continuous-verification](), [cybersecurity](), [devsecops](), [secure-software-development-frameworks](), [security](), [sigstore](), [slsa](), [software-supply-chain](), [software-supply-chain-security](), [ssdf]() ### AI overview This commentary explains NSA and DHS CISA guidance for securing CI/CD environments. It highlights risks to downstream environments and software consumers, including compromised developer credentials and application libraries, and recommends established software supply chain security frameworks such as SLSA and CNCF best practices. ### Source excerpt Fortify your CI/CD environments with insights from NSA and DHS CISA guidance, presented by Chainguard. ## An enhanced Chainguard Academy learning experience DevFeed: [An enhanced Chainguard Academy learning experience]() Original publisher: [Read original article]() Published: 2023-06-22T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [Learning](), [supply-chain-security](), [Security](), [Documentation](), [chainguard images](), [Open Source]() Tags: [chainguard](), [chainguard-academy](), [chainguard-images](), [sboms](), [security](), [slsa](), [slsa-levels](), [software-education](), [software-supply-chain](), [software-supply-chain-security](), [ssdf]() ### AI overview Chainguard announces an enhanced Chainguard Academy with a redesigned user experience, improved navigation, topic pages, and expanded educational resources covering software security, software supply chain security, SLSA, SSDF, SBOMs, apko, and Wolfi. The article also highlights ongoing product documentation updates for Chainguard Images and Chainguard Enforce. ### Source excerpt Catch the latest updates from Chainguard Academy, including a new design and software security resources for SLSA, SSDF and more. ## Government perspectives on software self-attestation requirements DevFeed: [Government perspectives on software self-attestation requirements]() Original publisher: [Read original article]() Published: 2023-06-15T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [supply-chain-security](), [cisa](), [Cybersecurity](), [chainguard](), [Security]() Tags: [chainguard](), [cisa](), [cybersecurity](), [fedramp](), [nist](), [open-source-security](), [regulatory](), [secure-by-design](), [security](), [self-attestation](), [software-supply-chain](), [software-supply-chain-security](), [ssdf]() ### AI overview Chainguard CEO Dan Lorenc and CISA Fellow Chris Hughes discuss CISA's draft software self-attestation form, its relationship to federal software supply chain security requirements, and the regulatory context surrounding secure software development. ### Source excerpt Chainguard CEO Dan Lorenc and Chris Hughes, CISO & Cofounder of Aquia and CISA Fellow discuss the upcoming software self-attestation form. ## The importance of toolchain security in NIST's SSDF DevFeed: [The importance of toolchain security in NIST's SSDF]() Original publisher: [Read original article]() Published: 2023-06-12T00:00:00Z Content type: opinion Language: en Sources: [Chainguard: Unchained]() Topics: [toolchain](), [Security](), [Architecture & Design](), [Software Engineering]() Tags: [cloud-security](), [fedramp](), [nist](), [secure-software](), [security](), [self-attestation](), [ssdf](), [supply-chain-attacks](), [toolchain]() ### AI overview This article argues that build systems and programming-language toolchains should be secured and inventoried like production systems. It discusses third-party code execution during installation and highlights Go toolchain vulnerabilities that enabled remote code execution during builds. ### Source excerpt The new Secure Software Development Framework (SSDF) from NIST places toolchain inventory management and security front and center. ## Celebrating 5 years of NTIA's SBOM work DevFeed: [Celebrating 5 years of NTIA's SBOM work]() Original publisher: [Read original article]() Published: 2023-06-07T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [supply-chain-security](), [Cybersecurity](), [Security](), [chainguard](), [cisa](), [distroless]() Tags: [chainguard](), [cisa](), [cybersecurity](), [distroless](), [fedramp](), [openvex](), [sbom](), [software-bill-of-materials](), [software-dark-matter](), [software-supply-chain](), [software-supply-chain-security](), [sofware-supply-chain](), [ssdf](), [vex](), [vulnerability-scanning]() ### AI overview The article commemorates five years of the NTIA's Software Bill of Materials work and reviews the development of SBOMs as a foundation of software supply chain security. It describes the NTIA's initiative, its multi-stakeholder guidelines, and CISA's continuing role in advancing software transparency. ### Source excerpt Celebrate 5 transformative years of SBOM work with Chainguard, reflecting on the journey of software bill of materials. ## How to explain the CISA software attestation requirements to your board DevFeed: [How to explain the CISA software attestation requirements to your board]() Original publisher: [Read original article]() Published: 2023-05-05T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [supply-chain-security](), [cisa](), [cybersecurity and infrastructure security agency](), [software bill of materials](), [Security]() Tags: [attestation](), [chainguard](), [cisa](), [container-security](), [government](), [national-cybersecurity-strategy](), [nist](), [policy](), [sbom](), [sboms](), [secure-container-image](), [secure-software](), [self-attestation](), [signing-artifacts](), [sigstore](), [software-artifact-signing](), [software-bill-of-materials](), [software-supply-chain-security](), [ssdf]() ### AI overview This article explains how software companies can brief their boards on CISA software attestation requirements and the broader federal software supply chain security policy landscape. It discusses Executive Order 14028, SBOMs, secure software development, CISA's Secure Software Development Attestation Form, and the requirements in OMB Memorandum M-22-18, including alignment with NIST guidance. ### Source excerpt CISA's draft self-attestation form clarifies the minimum requirements that software developers must meet to comply with OMB Memorandum M-22-18. ## The National CyberSecurity Strategy: Liability is Coming DevFeed: [The National CyberSecurity Strategy: Liability is Coming]() Original publisher: [Read original article]() Author: Adam Published: 2023-03-21T00:00:00Z Content type: opinion Language: en Sources: [Shostack & Friends Blog]() Topics: [Cybersecurity](), [Security & Privacy]() Tags: [cybersecurity](), [nist](), [security](), [ssdf](), [standard](), [strategy](), [us]() ### AI overview This commentary discusses the new US National Cybersecurity Strategy, focusing on its proposed shift of software and service liability toward manufacturers and providers. It outlines three elements: limiting contractual disclaimers, establishing a standard of care, and creating a safe harbor for companies that take reasonable, measurable security measures. The author expects debate over how eligibility for the safe harbor will be defined. ### Source excerpt The National CyberSecurity Strategy: Liability is Coming After months of signals, the new US National CyberSecurity Strategy is out, and I can stop beating around the bush and be explicit: Liability is coming. There's lots more in the Strategy. Bruce Schneier has a good roundup of first responses. I didn't to try to provide a hot take on it, because I think others did a fine job. ## The Appsec Landscape in 2023 DevFeed: [The Appsec Landscape in 2023]() Original publisher: [Read original article]() Author: Adam Published: 2023-01-05T00:00:00Z Content type: article Language: en Sources: [Shostack & Friends Blog]() Topics: [Application Security](), [Security](), [Requirements](), [open-source-security]() Tags: [appsec](), [changes](), [circleci](), [driving](), [external](), [government](), [legacy](), [requirements](), [secure-software](), [ssdf](), [supply-chain]() ### AI overview This article examines how economic conditions, new regulations, and engineering considerations may shape application security decisions in 2023. It emphasizes threat modeling, secure software development requirements, legacy code, and software supply-chain concerns. ### Source excerpt External changes will be driving appsec in 2023. It's time to frame the decisions in front of you. ## NIST Opens Comments on Draft Secure Software Development Framework DevFeed: [NIST Opens Comments on Draft Secure Software Development Framework]() Original publisher: [Read original article]() Author: Adam Published: 2019-07-11T00:00:00Z Content type: article Language: en Sources: [Shostack & Friends Blog]() Topics: [Vulnerabilities](), [Application Security](), [Software Engineering]() Tags: [adopting](), [framework](), [nist](), [open](), [risk](), [secure-software](), [ssdf](), [vulnerabilities]() ### AI overview NIST has released a draft Secure Software Development Framework (SSDF) for public comment, with comments accepted through August 5. ### Source excerpt Mitigating the Risk of Software Vulnerabilities by Adopting a Secure Software Development Framework (SSDF) from NIST is open for comment.