Tetap teratur dengan koleksi
Simpan dan kategorikan konten berdasarkan preferensi Anda.
Dokumentasi ini berfokus terutama pada praktik terbaik yang mendukung perlindungan
software Anda di seluruh proses dan sistem dalam supply chain software Anda. Dokumen ini juga menyertakan informasi tentang cara menerapkan beberapa praktik diGoogle Cloud.
Ada pertimbangan tambahan untuk melindungi software Anda yang mencakup
siklus proses software atau merupakan praktik pengembangan dasar yang mendukung
keamanan supply chain software. Contoh:
Mengontrol akses fisik dan jarak jauh ke sistem.
Menerapkan mekanisme audit, pemantauan, dan masukan sehingga Anda dapat
mengidentifikasi dan merespons ancaman serta ketidakpatuhan terhadap kebijakan dengan cepat.
Praktik coding dasar termasuk desain, validasi input, output ke
sistem yang tidak tepercaya, pemrosesan data, analisis kode, dan kriptografi.
Praktik DevOps dasar di luar yang disebutkan dalam dokumentasi ini,
termasuk pendekatan teknis, proses tim, dan budaya organisasi.
Kepatuhan terhadap persyaratan lisensi software, termasuk lisensi open source untuk
dependensi langsung dan transitif.
Beberapa lisensi open source memiliki persyaratan lisensi yang membatasi dan bermasalah
untuk software komersial. Secara khusus, beberapa lisensi mengharuskan Anda merilis
kode sumber berdasarkan lisensi yang sama dengan software open source yang
Anda gunakan kembali. Jika Anda ingin menjaga kode sumber tetap bersifat pribadi, penting
untuk mengetahui persyaratan lisensi software open source yang Anda gunakan.
Meningkatkan kesadaran tentang keamanan cyber dengan memberikan pelatihan kepada karyawan.
Menurut Kondisi Keamanan Cyber 2021, Bagian 2, survei
profesional keamanan informasi, manipulasi psikologis adalah jenis serangan
yang paling sering terjadi. Responden survei juga melaporkan bahwa program pelatihan dan
kesadaran keamanan siber memiliki beberapa dampak positif (46%) atau dampak positif
yang kuat (32%) terhadap kesadaran karyawan.
Gunakan referensi di bagian berikut untuk mempelajari topik ini lebih lanjut.
Anda dapat melihat informasi terpusat tentang kerentanan dan kemungkinan
risiko menggunakan layanan Google Cloud ini:
Lihat informasi tentang kerentanan dan ancaman di seluruh organisasi Google Cloud
Anda dengan Security Command Center.
Dapatkan informasi tentang penggunaan layanan Anda dengan Recommender,
termasuk rekomendasi yang dapat membantu Anda mengurangi risiko. Misalnya,
Anda dapat mengidentifikasi akun utama IAM dengan izin berlebih atau
project Google Cloud yang tidak diawasi.
Lihat dokumentasi kemampuan DevOps
untuk mempelajari lebih lanjut praktik DevOps yang berkontribusi pada pengiriman
software yang lebih cepat serta software yang lebih andal dan aman.
Ada juga praktik dasar untuk mendesain, mengembangkan, dan menguji
kode yang berlaku untuk semua bahasa pemrograman. Anda juga perlu mengevaluasi cara
mendistribusikan software dan persyaratan lisensi software di semua
dependensi Anda. Linux Foundation menawarkan pelatihan online gratis tentang topik berikut:
Developing Secure Software: Praktik
pengembangan software dasar dalam konteks keamanan
supply chain software. Kursus ini berfokus pada praktik terbaik untuk mendesain, mengembangkan, dan
menguji kode, tetapi juga mencakup topik seperti menangani pengungkapan kerentanan,
kasus jaminan, dan pertimbangan untuk distribusi dan deployment software.
Open Source Security Foundation (OpenSSF)
membuat pelatihan ini.
Saat Anda menerapkan praktik terbaik secara bertahap, dokumentasikan kebijakan untuk organisasi Anda dan sertakan validasi kebijakan ke dalam proses pengembangan, build, dan deployment Anda. Misalnya, kebijakan perusahaan Anda mungkin
menyertakan kriteria untuk deployment yang Anda terapkan dengan Otorisasi Biner.
Minimum Viable Secure Product, checklist kontrol keamanan untuk menetapkan postur keamanan dasar pengukuran untuk produk. Anda dapat menggunakan checklist untuk menetapkan persyaratan kontrol keamanan minimum dan mengevaluasi software oleh vendor pihak ketiga.
[[["Mudah dipahami","easyToUnderstand","thumb-up"],["Memecahkan masalah saya","solvedMyProblem","thumb-up"],["Lainnya","otherUp","thumb-up"]],[["Sulit dipahami","hardToUnderstand","thumb-down"],["Informasi atau kode contoh salah","incorrectInformationOrSampleCode","thumb-down"],["Informasi/contoh yang saya butuhkan tidak ada","missingTheInformationSamplesINeed","thumb-down"],["Masalah terjemahan","translationIssue","thumb-down"],["Lainnya","otherDown","thumb-down"]],["Terakhir diperbarui pada 2025-08-18 UTC."],[],[],null,["# Protect your software supply chain\n\nThis documentation focuses primarily on best practices that support protecting\nyour software across processes and systems in your software supply chain. It\nalso includes information about how to implement some of the practices on\nGoogle Cloud.\n\n- [Safeguarding source integrity](/software-supply-chain-security/docs/safeguard-source)\n- [Safeguarding build integrity](/software-supply-chain-security/docs/safeguard-builds)\n- [Managing dependencies](/software-supply-chain-security/docs/dependencies)\n- [Safeguarding deployments](/software-supply-chain-security/docs/safeguard-deploys)\n\nThere are additional considerations for protecting your software that span the\nsoftware lifecycle or are foundational development practices that support\nsoftware supply chain security. For example:\n\n- Controlling physical and remote access to systems.\n- Implementing audit, monitoring, and feedback mechanisms so that you are able to quickly identify and respond to threats and non-compliance with policy.\n- Foundational coding practices including design, input validation, output to untrusted systems, data processing, code analysis, and cryptography.\n- Foundational DevOps practices beyond ones mentioned in this documentation, including technical approaches, team process, and organizational culture.\n- Adherence to software licenses terms, including open source licenses for\n direct and transitive dependencies.\n\n Some open source licenses have restrictive license terms that are problematic\n for commercial software. In particular, some licenses require you to release\n your source code under the same license as the open source software that you\n are reusing. If you want to keep your source code private, it's important\n to know the licenses terms of open source software you use.\n- Increasing awareness about cybersecurity by providing training to employees.\n According the [State of Cybersecurity 2021, Part 2](https://www.isaca.org/state-of-cybersecurity-2021), a survey of\n information security professionals, social engineering was the most frequent\n type of attack. Survey respondants also reported that cybersecurity training\n and awareness programs had some positive impact (46%) or strong positive\n impact (32%) on employee awareness.\n\nUse the resources in the following sections to learn more about these topics.\n\nSecurity on Google Cloud\n------------------------\n\nLearn about setting up organization structure, authentication and authorization,\nresource hierarchy, networking, logging, detective controls, and more in the\n[Google Cloud enterprise foundations blueprint](/architecture/security-foundations), one of\nthe guides in the\n[Google Cloud security best practices center](/security/best-practices).\n\nYou can view centralized information about vulnerabilities and possible\nrisks using these Google Cloud services:\n\n- View information about vulnerabilities and threats across your Google Cloud organization with [Security Command Center](/security-command-center/docs/security-command-center-overview).\n- Get information about your service usage with [Recommender](/recommender/docs/overview), including recommendations that can help you to reduce risk. For example, you can identify IAM principals with excess permissions or unattended Google Cloud projects.\n\nTo learn more about security on Google Cloud, see the\n[Security section of the Google Cloud web site](/security).\n\nDevOps and software development practices\n-----------------------------------------\n\nSee the [DevOps capabilities](https://dora.dev/devops-capabilities/)\ndocumentation to learn more about DevOps practices that contribute to faster\nsoftware delivery and more reliable and secure software.\n\nThere are also foundational practices for designing, developing, and testing\ncode that apply to all programming languages. You also need to evaluate how\nyou distribute software and the terms of software licenses in all of your\ndependencies. The Linux Foundation offers free online training on these topics:\n\n- [Developing Secure Software](https://training.linuxfoundation.org/training/developing-secure-software-lfd121/): Foundational software development practices in the context of software supply chain security. The course focuses on best practices for designing, developing, and testing code, but also covers topics such as handling vulnerability disclosures, assurance cases, and considerations for software distribution and deployment. The [Open Source Security Foundation](https://openssf.org/) (OpenSSF) created the training.\n- [Open Source Licensing Basics for Developers](https://training.linuxfoundation.org/training/open-source-licensing-basics-for-software-developers/) Learn about licenses and copyright for open source projects.\n- [Introduction to Open Source License Compliance Management](https://training.linuxfoundation.org/training/introduction-to-open-source-license-compliance-management-lfc193/) Learn about building an open source compliance program for your organization.\n\nDeveloping your policies\n------------------------\n\nAs you incrementally implement best practices, document the policies for your\norganization and incorporate validation of policies into your development,\nbuild, and deployment processes. For example, your company policies might\ninclude criteria for deployment that you implement with [Binary Authorization](/binary-authorization/docs/overview).\n\n- [Minimum Viable Secure Product](https://mvsp.dev), a security checklist of controls to establish a baseline security posture for a product. You can use the checklist to establish your minimum security control requirements and to evaluate software by third-party vendors.\n- NIST [Security and Privacy Controls for Information Systems and Organizations](https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final) publication (SP 800-53)."]]
