[[["易于理解","easyToUnderstand","thumb-up"],["解决了我的问题","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["很难理解","hardToUnderstand","thumb-down"],["信息或示例代码不正确","incorrectInformationOrSampleCode","thumb-down"],["没有我需要的信息/示例","missingTheInformationSamplesINeed","thumb-down"],["翻译问题","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["最后更新时间 (UTC)：2025-08-18。"],[],[],null,["# Assess your security posture\n\n*Security posture* is an organization's ability to detect, respond to,\nand remediate threats. It includes the readiness of an organization's people,\nhardware, software, policies and processes across the entire software lifecycle.\n\nThere are a number of frameworks and tools that you can use to assess your\nsecurity posture and identify ways to mitigate threats.\n\nSoftware delivery practices\n---------------------------\n\nA strong security posture requires a strong foundation in software delivery\nbest practices, and these practices go beyond implementing tools and technical\ncontrols. For example, if the change approval process is unclear, then it is easier\nfor unwanted changes to enter your software supply chain. If teams are\ndiscouraged from raising issues, they might hesitate to report security\nconcerns.\n\n[DevOps Research and Assessment](https://dora.dev/) (DORA) performs\nindependent research into practices and capabilities of high performance\ntechnology teams. To assess your team's performance and learn about ways to\nimprove, use the following DORA resources:\n\n- Take the [DORA DevOps Quick Check](https://dora.dev/quickcheck/) to get some quick feedback on how your organization compares with others.\n- Read about the technical, process, measurement, and cultural DevOps [capabilities](https://dora.dev/devops-capabilities/) identified by DORA.\n\nFrameworks for security posture\n-------------------------------\n\nThe [NIST Secure Software Development Framework](https://csrc.nist.gov/publications/detail/sp/800-218/final) (SSDF)\nand [Cybersecurity Assessment Framework](https://www.ncsc.gov.uk/collection/caf/cyber-assessment-framework) (CAF) are\nframeworks developed by governments to help organizations assess\ntheir security posture and mitigate supply chain threats. These frameworks\ntake into consideration the software development lifecycle as well as other\naspects related to software security such as incident response plans. The\ncomplexity and scope of these frameworks can require a substantial investment\nin time and resources.\n\n[Supply chain Levels for Software Artifacts (SLSA)](https://slsa.dev/) is\na framework that aims to make assessment and mitigation implementation more\napproachable and incremental. It explains supply chain threats and associated\nmitigations and provides examples of tools to implement mitigations. It also\ngroups requirements for strengthening your security posture in levels, so that\nyou can prioritize and incrementally implement changes. SLSA is primarily\nfocused on the software delivery pipeline, so you should use it together with\nother assessment tools like the SSDF and CAF.\n\nSLSA is inspired by Google's internal [Binary Authorization for Borg](/docs/security/binary-authorization-for-borg)\na mandatory enforcement check for all of Google's production workloads.\n\nGoogle Cloud provides a modular set of capabilities and tools that incorporate\nbest practices in SLSA. You can view insights about your security posture,\nincluding the SLSA level of your builds.\n\nArtifact and dependency management\n----------------------------------\n\nVisibility into vulnerabilities in your software lets you proactively respond\nand remediate potential threats before you release your applications to your\ncustomers. You can use the following tools to get more visibility into\nvulnerabilities.\n\nVulnerability scanning\n: Vulnerability scanning services such as [Artifact Analysis](/container-analysis/docs/container-analysis)\n help you to identify known vulnerabilities in your software.\n\nDependency management\n\n: Open Source Insights is a centralized source for information about dependency\n graphs, known vulnerabilities, and licenses associated with open source\n software. Use the site to learn about your dependencies.\n\n The Open Source Insights project also makes this data available as an\n [Google Cloud Dataset](https://console.cloud.google.com/marketplace/product/bigquery-public-data/deps-dev). You can use\n [BigQuery](/bigquery/docs/introduction) to explore and analyze the data.\n\nSource control policy\n\n: [Scorecards](https://github.com/ossf/scorecard) is an automated tool that\n identifies risky software supply chain practices in your GitHub projects.\n\n: [Allstar](https://github.com/ossf/allstar) is a GitHub App that continuously\n monitors GitHub organizations or repositories for adherence to configured\n policies. For example, you can apply a policy to your GitHub organization\n that checks for collaborators outside the organization who have administrator\n or push access.\n\nTo learn more about managing your dependencies, see\n[Dependency management](/software-supply-chain-security/docs/dependencies)\n\nTeam awareness about cybersecurity\n----------------------------------\n\nIf your teams have an understanding of software supply chain threats and\nbest practices, they can design and develop more secure applications.\n\nIn the [State of Cybersecurity 2021, Part 2](https://www.isaca.org/state-of-cybersecurity-2021), a survey of\ninformation security professionals, survey respondants reported that\ncybersecurity training and awareness programs had some positive impact\n(46%) or strong positive impact (32%) on employee awareness.\n\nThe following resources can help you learn more about supply chain security and\nsecurity on Google Cloud:\n\n- [Google Cloud enterprise foundation blueprint](/architecture/security-foundations) describes setting up organization structure, authentication and authorization, resource hierarchy, networking, logging, detective controls, and more. It is one of the guides in the [Google Cloud security best practices center](/security/best-practices).\n- [Developing Secure Software](https://training.linuxfoundation.org/training/developing-secure-software-lfd121/) teaches foundational software development practices in the context of software supply chain security. The course focuses on best practices for designing, developing, and testing code, but also covers topics such as handling vulnerability disclosures, assurance cases, and considerations for software distribution and deployment. The [Open Source Security Foundation](https://openssf.org/) (OpenSSF) created the training.\n\nPreparing for change\n--------------------\n\nAfter you have identified changes you want to make, you need to plan for the\nchanges.\n\n- Identify best practices and mitigations to improve the reliability and security of your supply chain.\n- Develop guidelines and policies to ensure that teams implement changes\n and measure compliance consistently. For example, your company policies might\n include criteria for deployment that you implement with\n [Binary Authorization](/binary-authorization/docs/overview). The following resources can help you:\n\n - [Minimum Viable Secure Product](https://mvsp.dev), a security checklist of controls to establish a baseline security posture for a product. You can use the checklist to establish your minimum security control requirements and to evaluate software by third-party vendors.\n - NIST [Security and Privacy Controls for Information Systems and Organizations](https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final) publication (SP 800-53).\n- Plan for incremental changes to reduce the size, complexity, and impact\n of each change. It also helps the people on your teams to adjust to\n each change, provide feedback, and apply lessons you've learned to the\n future changes.\n\nThe following resources can help you with planning and implementing\nchange.\n\n- [ROI of DevOps Transformation](/resources/roi-of-devops-transformation-whitepaper) is a white paper that\n describes how to forecast the value of and justify investment in DevOps\n transformation.\n\n- The Google [Cloud Application Modernization Program](/camp) provides holistic,\n guided assessment, measuring key outcomes (speed and stability and burnout)\n and identifying the technical, process, and cultural capabilities that improve\n those outcomes for your organization. See the\n [CAMP announcement blog post](https://cloud.google.com/blog/products/application-development/google-camp-shows-you-how-to-operate-at-scale) for more\n information about the program.\n\n- [How to transform](https://dora.dev/devops-capabilities/cultural/devops-culture-transform/) provides guidance to help you\n plan for and implement changes. Fostering a culture that supports incremental,\n ongoing change leads to more successful change outcomes.\n\n- The [NIST Secure Software Delivery Framework](https://csrc.nist.gov/Projects/ssdf)\n describes software security practices based on established practices from\n organizations such as [The Software Alliance](https://www.bsa.org/),\n [Open Web Application Security Project](https://owasp.org/), and\n [SAFECode](https://safecode.org/). It includes a set of practices to\n prepare your organization as well as practices for implementing changes\n and responding to vulnerabilities.\n\nWhat's next\n-----------\n\n- Learn about [best practices](/software-supply-chain-security/docs/practices) to protect your software supply chain.\n- Learn about [software supply chain security](/software-supply-chain-security/docs/overview) and the Google Cloudproducts and features that help you to protect your software supply chain."]]
