Software Supply Chain Security

This course covers the theory behind software supply chain attacks, from simple cases of typo squatting and dependency confusion to advanced compromise techniques targeting build systems, update mechanisms, and trusted third-party components. It explains how attackers exploit open-source ecosystems, package repositories, and developer workflows to introduce malicious code into otherwise legitimate software. The course also addresses the need for organizations to prepare for this growing threat through secure development practices, dependency governance, code signing, artifact integrity checks, and continuous monitoring. Participants will learn how to use free and open-source software more safely while reducing operational and security risk.