보안 상황은 조직이 위협을 감지, 대응, 해결하는 능력입니다. 여기에는 전체 소프트웨어 수명 주기에 걸쳐 조직의 인력, 하드웨어, 소프트웨어, 정책, 프로세스의 준비 상태가 포함됩니다.
보안 상황을 평가하고 위협을 완화하는 방법을 식별하는 데 사용할 수 있는 프레임워크와 도구가 많이 있습니다.
소프트웨어 배포 권장사항
강력한 보안 수준은 소프트웨어 배포 권장사항을 위한 강력한 토대가 필요하며, 이러한 권장사항은 도구 및 기술 제어 구현을 넘어서는 것입니다. 예를 들어 변경 승인 프로세스가 명확하지 않은 경우 원치 않는 변경사항이 소프트웨어 공급망에 더 쉽게 진입할 수 있습니다. 팀의 문제 제기가 권장되지 않을 경우에는 보안 문제 보고를 주저할 수 있습니다.
SLSA(Supply Chain Levels for Software Artifacts)는 평가 및 완화 구현을 보다 쉽고 점진적으로 수행할 수 있도록 만드는 프레임워크입니다. 공급망 위협 및 관련 완화 조치를 설명하고 완화 조치를 구현하기 위한 도구의 예시를 제공합니다. 또한 보안 상황을 강화하기 위한 요구 사항을 수준별로 그룹화하여 우선 순위를 정하고 점진적으로 변경을 수행할 수 있습니다. SLSA는 주로 소프트웨어 배포 파이프라인에 중점을 두므로 SSDF 및 CAF와 같은 다른 평가 도구와 함께 사용해야 합니다.
보안 소프트웨어 개발에서는 소프트웨어 공급망 보안과 관련하여 기본 소프트웨어 개발 권장사항을 설명합니다. 이 과정에서는 코드 설계, 개발, 테스트를 위한 권장사항에 중점을 두고 있지만 취약점 공개, 보증 사례, 소프트웨어 배포, 배포 고려사항과 같은 주제도 다룹니다. Open Source Security Foundation(OpenSSF)에서 교육을 만들었습니다.
변화에 대비
변경사항을 확인한 후에는 변경사항을 계획해야 합니다.
공급망의 안정성과 보안을 개선하기 위한 권장사항 및 완화 조치를 파악하세요.
팀이 변경사항을 구현하고 규정 준수를 일관되게 측정할 수 있도록 가이드라인과 정책을 수립합니다. 예를 들어 회사 정책에는 Binary Authorization으로 구현하는 배포 기준이 포함될 수 있습니다. 다음 리소스가 도움이 될 수 있습니다.
최소 필수 보안 제품 - 제품의 기준 보안 상태를 설정하기 위한 보안 제어 체크리스트입니다. 이 체크리스트는 최소 보안 제어 요구사항을 설정하고 서드 파티 공급업체의 소프트웨어를 평가하는 데 사용할 수 있습니다.
각 변경의 규모, 복잡성, 영향을 줄이기 위해 증분 변경을 계획합니다. 또한 팀원이 각 변경사항에 적응하고 피드백을 제공하며 학습한 사항을 향후 변경에 적용하는 데 도움이 됩니다.
다음 리소스는 변경을 계획하고 구현하는 데 도움이 됩니다.
DevOps 혁신의 ROI는 DevOps 혁신의 가치를 예측하고 투자를 정당화하는 방법을 설명하는 백서입니다.
Google Cloud 애플리케이션 현대화 프로그램은 종합적인 가이드 평가를 제공하여 주요 결과(속도, 안정성 및 번아웃)를 측정하고 조직의 결과를 개선하는 기술, 프로세스, 문화적 역량을 식별합니다. 프로그램에 대한 자세한 내용은 CAMP 공지사항 블로그 게시물을 참조하세요.
변경 방법에서는 변경사항을 계획하고 구현하는 데 도움이 되는 안내를 제공합니다. 점진적이고 지속적인 변경을 지원하는 문화를 조성하면 보다 성공적으로 변경을 수행할 수 있습니다.
[[["이해하기 쉬움","easyToUnderstand","thumb-up"],["문제가 해결됨","solvedMyProblem","thumb-up"],["기타","otherUp","thumb-up"]],[["이해하기 어려움","hardToUnderstand","thumb-down"],["잘못된 정보 또는 샘플 코드","incorrectInformationOrSampleCode","thumb-down"],["필요한 정보/샘플이 없음","missingTheInformationSamplesINeed","thumb-down"],["번역 문제","translationIssue","thumb-down"],["기타","otherDown","thumb-down"]],["최종 업데이트: 2025-09-04(UTC)"],[],[],null,["# Assess your security posture\n\n*Security posture* is an organization's ability to detect, respond to,\nand remediate threats. It includes the readiness of an organization's people,\nhardware, software, policies and processes across the entire software lifecycle.\n\nThere are a number of frameworks and tools that you can use to assess your\nsecurity posture and identify ways to mitigate threats.\n\nSoftware delivery practices\n---------------------------\n\nA strong security posture requires a strong foundation in software delivery\nbest practices, and these practices go beyond implementing tools and technical\ncontrols. For example, if the change approval process is unclear, then it is easier\nfor unwanted changes to enter your software supply chain. If teams are\ndiscouraged from raising issues, they might hesitate to report security\nconcerns.\n\n[DevOps Research and Assessment](https://dora.dev/) (DORA) performs\nindependent research into practices and capabilities of high performance\ntechnology teams. To assess your team's performance and learn about ways to\nimprove, use the following DORA resources:\n\n- Take the [DORA DevOps Quick Check](https://dora.dev/quickcheck/) to get some quick feedback on how your organization compares with others.\n- Read about the technical, process, measurement, and cultural DevOps [capabilities](https://dora.dev/devops-capabilities/) identified by DORA.\n\nFrameworks for security posture\n-------------------------------\n\nThe [NIST Secure Software Development Framework](https://csrc.nist.gov/publications/detail/sp/800-218/final) (SSDF)\nand [Cybersecurity Assessment Framework](https://www.ncsc.gov.uk/collection/caf/cyber-assessment-framework) (CAF) are\nframeworks developed by governments to help organizations assess\ntheir security posture and mitigate supply chain threats. These frameworks\ntake into consideration the software development lifecycle as well as other\naspects related to software security such as incident response plans. The\ncomplexity and scope of these frameworks can require a substantial investment\nin time and resources.\n\n[Supply chain Levels for Software Artifacts (SLSA)](https://slsa.dev/) is\na framework that aims to make assessment and mitigation implementation more\napproachable and incremental. It explains supply chain threats and associated\nmitigations and provides examples of tools to implement mitigations. It also\ngroups requirements for strengthening your security posture in levels, so that\nyou can prioritize and incrementally implement changes. SLSA is primarily\nfocused on the software delivery pipeline, so you should use it together with\nother assessment tools like the SSDF and CAF.\n\nSLSA is inspired by Google's internal [Binary Authorization for Borg](/docs/security/binary-authorization-for-borg)\na mandatory enforcement check for all of Google's production workloads.\n\nGoogle Cloud provides a modular set of capabilities and tools that incorporate\nbest practices in SLSA. You can view insights about your security posture,\nincluding the SLSA level of your builds.\n\nArtifact and dependency management\n----------------------------------\n\nVisibility into vulnerabilities in your software lets you proactively respond\nand remediate potential threats before you release your applications to your\ncustomers. You can use the following tools to get more visibility into\nvulnerabilities.\n\nVulnerability scanning\n: Vulnerability scanning services such as [Artifact Analysis](/container-analysis/docs/container-analysis)\n help you to identify known vulnerabilities in your software.\n\nDependency management\n\n: Open Source Insights is a centralized source for information about dependency\n graphs, known vulnerabilities, and licenses associated with open source\n software. Use the site to learn about your dependencies.\n\n The Open Source Insights project also makes this data available as an\n [Google Cloud Dataset](https://console.cloud.google.com/marketplace/product/bigquery-public-data/deps-dev). You can use\n [BigQuery](/bigquery/docs/introduction) to explore and analyze the data.\n\nSource control policy\n\n: [Scorecards](https://github.com/ossf/scorecard) is an automated tool that\n identifies risky software supply chain practices in your GitHub projects.\n\n: [Allstar](https://github.com/ossf/allstar) is a GitHub App that continuously\n monitors GitHub organizations or repositories for adherence to configured\n policies. For example, you can apply a policy to your GitHub organization\n that checks for collaborators outside the organization who have administrator\n or push access.\n\nTo learn more about managing your dependencies, see\n[Dependency management](/software-supply-chain-security/docs/dependencies)\n\nTeam awareness about cybersecurity\n----------------------------------\n\nIf your teams have an understanding of software supply chain threats and\nbest practices, they can design and develop more secure applications.\n\nIn the [State of Cybersecurity 2021, Part 2](https://www.isaca.org/state-of-cybersecurity-2021), a survey of\ninformation security professionals, survey respondants reported that\ncybersecurity training and awareness programs had some positive impact\n(46%) or strong positive impact (32%) on employee awareness.\n\nThe following resources can help you learn more about supply chain security and\nsecurity on Google Cloud:\n\n- [Google Cloud enterprise foundation blueprint](/architecture/security-foundations) describes setting up organization structure, authentication and authorization, resource hierarchy, networking, logging, detective controls, and more. It is one of the guides in the [Google Cloud security best practices center](/security/best-practices).\n- [Developing Secure Software](https://training.linuxfoundation.org/training/developing-secure-software-lfd121/) teaches foundational software development practices in the context of software supply chain security. The course focuses on best practices for designing, developing, and testing code, but also covers topics such as handling vulnerability disclosures, assurance cases, and considerations for software distribution and deployment. The [Open Source Security Foundation](https://openssf.org/) (OpenSSF) created the training.\n\nPreparing for change\n--------------------\n\nAfter you have identified changes you want to make, you need to plan for the\nchanges.\n\n- Identify best practices and mitigations to improve the reliability and security of your supply chain.\n- Develop guidelines and policies to ensure that teams implement changes\n and measure compliance consistently. For example, your company policies might\n include criteria for deployment that you implement with\n [Binary Authorization](/binary-authorization/docs/overview). The following resources can help you:\n\n - [Minimum Viable Secure Product](https://mvsp.dev), a security checklist of controls to establish a baseline security posture for a product. You can use the checklist to establish your minimum security control requirements and to evaluate software by third-party vendors.\n - NIST [Security and Privacy Controls for Information Systems and Organizations](https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final) publication (SP 800-53).\n- Plan for incremental changes to reduce the size, complexity, and impact\n of each change. It also helps the people on your teams to adjust to\n each change, provide feedback, and apply lessons you've learned to the\n future changes.\n\nThe following resources can help you with planning and implementing\nchange.\n\n- [ROI of DevOps Transformation](/resources/roi-of-devops-transformation-whitepaper) is a white paper that\n describes how to forecast the value of and justify investment in DevOps\n transformation.\n\n- The Google [Cloud Application Modernization Program](/camp) provides holistic,\n guided assessment, measuring key outcomes (speed and stability and burnout)\n and identifying the technical, process, and cultural capabilities that improve\n those outcomes for your organization. See the\n [CAMP announcement blog post](https://cloud.google.com/blog/products/application-development/google-camp-shows-you-how-to-operate-at-scale) for more\n information about the program.\n\n- [How to transform](https://dora.dev/devops-capabilities/cultural/devops-culture-transform/) provides guidance to help you\n plan for and implement changes. Fostering a culture that supports incremental,\n ongoing change leads to more successful change outcomes.\n\n- The [NIST Secure Software Delivery Framework](https://csrc.nist.gov/Projects/ssdf)\n describes software security practices based on established practices from\n organizations such as [The Software Alliance](https://www.bsa.org/),\n [Open Web Application Security Project](https://owasp.org/), and\n [SAFECode](https://safecode.org/). It includes a set of practices to\n prepare your organization as well as practices for implementing changes\n and responding to vulnerabilities.\n\nWhat's next\n-----------\n\n- Learn about [best practices](/software-supply-chain-security/docs/practices) to protect your software supply chain.\n- Learn about [software supply chain security](/software-supply-chain-security/docs/overview) and the Google Cloudproducts and features that help you to protect your software supply chain."]]
