Strengthening the Nessus Software Supply Chain with SLSA
Summary
You know Tenable as a cybersecurity industry leader whose world-class exposure management products are trusted by our approximately 43,000 customers, including about 60% of the Fortune 500. The SLSA framework, developed by Google, is described on its website as a “set of incrementally adoptable guidelines for supply chain security, established by industry consensus.” Its goal? “Likewise, the SLSA framework provides this trust with guidelines and tamper-resistant evidence for securing each step of the software production process,” it adds. As part of the adoption of these SLSA Level 1 requirements, we encountered a notable challenge that we feel is worth mentioning: The inadvertent exposure of secrets during the provenance collection and compilation is a critical concern. In closing, we hope this blog post proves useful and informative for organizations that are considering adopting the SLSA framework to improve the security of their software supply chain.