소프트웨어 수명 주기를 포괄하는 소프트웨어 보호를 위한 추가 고려사항이 있거나 소프트웨어 공급망 보안을 지원하는 기본 개발 권장사항이 있습니다. 예를 들면 다음과 같습니다.
시스템에 대한 물리적 및 원격 액세스 제어
위협과 정책 위반 사항을 빠르게 식별하고 대응할 수 있도록 감사, 모니터링, 피드백 메커니즘 구현
설계, 입력 검증, 신뢰할 수 없는 시스템으로의 출력, 데이터 처리, 코드 분석, 암호화 등 기본적인 코딩 권장사항
기술 접근 방식, 팀 프로세스, 조직 문화 등 이 문서에서 언급된 것 이상의 기본 DevOps 권장사항
직접 및 임시 종속 항목의 오픈소스 라이선스 등 소프트웨어 라이선스 약관 준수
일부 오픈소스 라이선스에는 상용 소프트웨어에 대한 문제가 있는 제한적인 라이선스 약관이 있습니다. 특히 일부 라이선스에서는 재사용하고 있는 오픈소스 소프트웨어와 동일한 라이선스에 따라 소스 코드 공개를 요구합니다. 소스 코드를 비공개로 유지하려면 사용하는 오픈소스 소프트웨어의 라이선스 약관을 알고 있어야 합니다.
직원을 교육시켜 사이버 보안에 대한 인식 강화.
정보 보안 전문가를 대상으로 한 설문조사인 2021년 사이버 보안 현황 2부에 따르면 소셜 엔지니어링이 가장 빈번한 공격 유형이었습니다. 또한 설문조사 응답자들은 사이버 보안 교육 및 인식 프로그램이 직원 인식에 긍정적인 영향을 미치거나(46%) 강력한 긍정적인 영향을 미친다고(32%) 보고했습니다.
더 빠른 소프트웨어 배포 및 더 안정적이고 안전한 소프트웨어에 기여하는 DevOps 권장사항에 대한 자세한 내용은 DevOps 기능 문서를 참조하세요.
또한 모든 프로그래밍 언어에 적용되는 코드 설계, 개발, 테스트를 위한 기본 권장사항도 있습니다. 또한 모든 종속 항목에서 소프트웨어 배포 방식과 소프트웨어 라이선스 약관을 평가해야 합니다. Linux Foundation에서는 다음 주제에 대한 무료 온라인 교육을 제공합니다.
보안 소프트웨어 개발: 소프트웨어 공급망 보안과 관련된 기본 소프트웨어 개발 권장사항입니다. 이 과정에서는 코드 설계, 개발, 테스트를 위한 권장사항에 중점을 두고 있지만 취약점 공개, 보증 사례, 소프트웨어 배포, 배포 고려사항과 같은 주제도 다룹니다.
Open Source Security Foundation(OpenSSF)에서 교육을 만들었습니다.
[[["이해하기 쉬움","easyToUnderstand","thumb-up"],["문제가 해결됨","solvedMyProblem","thumb-up"],["기타","otherUp","thumb-up"]],[["이해하기 어려움","hardToUnderstand","thumb-down"],["잘못된 정보 또는 샘플 코드","incorrectInformationOrSampleCode","thumb-down"],["필요한 정보/샘플이 없음","missingTheInformationSamplesINeed","thumb-down"],["번역 문제","translationIssue","thumb-down"],["기타","otherDown","thumb-down"]],["최종 업데이트: 2025-09-04(UTC)"],[],[],null,["# Protect your software supply chain\n\nThis documentation focuses primarily on best practices that support protecting\nyour software across processes and systems in your software supply chain. It\nalso includes information about how to implement some of the practices on\nGoogle Cloud.\n\n- [Safeguarding source integrity](/software-supply-chain-security/docs/safeguard-source)\n- [Safeguarding build integrity](/software-supply-chain-security/docs/safeguard-builds)\n- [Managing dependencies](/software-supply-chain-security/docs/dependencies)\n- [Safeguarding deployments](/software-supply-chain-security/docs/safeguard-deploys)\n\nThere are additional considerations for protecting your software that span the\nsoftware lifecycle or are foundational development practices that support\nsoftware supply chain security. For example:\n\n- Controlling physical and remote access to systems.\n- Implementing audit, monitoring, and feedback mechanisms so that you are able to quickly identify and respond to threats and non-compliance with policy.\n- Foundational coding practices including design, input validation, output to untrusted systems, data processing, code analysis, and cryptography.\n- Foundational DevOps practices beyond ones mentioned in this documentation, including technical approaches, team process, and organizational culture.\n- Adherence to software licenses terms, including open source licenses for\n direct and transitive dependencies.\n\n Some open source licenses have restrictive license terms that are problematic\n for commercial software. In particular, some licenses require you to release\n your source code under the same license as the open source software that you\n are reusing. If you want to keep your source code private, it's important\n to know the licenses terms of open source software you use.\n- Increasing awareness about cybersecurity by providing training to employees.\n According the [State of Cybersecurity 2021, Part 2](https://www.isaca.org/state-of-cybersecurity-2021), a survey of\n information security professionals, social engineering was the most frequent\n type of attack. Survey respondants also reported that cybersecurity training\n and awareness programs had some positive impact (46%) or strong positive\n impact (32%) on employee awareness.\n\nUse the resources in the following sections to learn more about these topics.\n\nSecurity on Google Cloud\n------------------------\n\nLearn about setting up organization structure, authentication and authorization,\nresource hierarchy, networking, logging, detective controls, and more in the\n[Google Cloud enterprise foundations blueprint](/architecture/security-foundations), one of\nthe guides in the\n[Google Cloud security best practices center](/security/best-practices).\n\nYou can view centralized information about vulnerabilities and possible\nrisks using these Google Cloud services:\n\n- View information about vulnerabilities and threats across your Google Cloud organization with [Security Command Center](/security-command-center/docs/security-command-center-overview).\n- Get information about your service usage with [Recommender](/recommender/docs/overview), including recommendations that can help you to reduce risk. For example, you can identify IAM principals with excess permissions or unattended Google Cloud projects.\n\nTo learn more about security on Google Cloud, see the\n[Security section of the Google Cloud web site](/security).\n\nDevOps and software development practices\n-----------------------------------------\n\nSee the [DevOps capabilities](https://dora.dev/devops-capabilities/)\ndocumentation to learn more about DevOps practices that contribute to faster\nsoftware delivery and more reliable and secure software.\n\nThere are also foundational practices for designing, developing, and testing\ncode that apply to all programming languages. You also need to evaluate how\nyou distribute software and the terms of software licenses in all of your\ndependencies. The Linux Foundation offers free online training on these topics:\n\n- [Developing Secure Software](https://training.linuxfoundation.org/training/developing-secure-software-lfd121/): Foundational software development practices in the context of software supply chain security. The course focuses on best practices for designing, developing, and testing code, but also covers topics such as handling vulnerability disclosures, assurance cases, and considerations for software distribution and deployment. The [Open Source Security Foundation](https://openssf.org/) (OpenSSF) created the training.\n- [Open Source Licensing Basics for Developers](https://training.linuxfoundation.org/training/open-source-licensing-basics-for-software-developers/) Learn about licenses and copyright for open source projects.\n- [Introduction to Open Source License Compliance Management](https://training.linuxfoundation.org/training/introduction-to-open-source-license-compliance-management-lfc193/) Learn about building an open source compliance program for your organization.\n\nDeveloping your policies\n------------------------\n\nAs you incrementally implement best practices, document the policies for your\norganization and incorporate validation of policies into your development,\nbuild, and deployment processes. For example, your company policies might\ninclude criteria for deployment that you implement with [Binary Authorization](/binary-authorization/docs/overview).\n\n- [Minimum Viable Secure Product](https://mvsp.dev), a security checklist of controls to establish a baseline security posture for a product. You can use the checklist to establish your minimum security control requirements and to evaluate software by third-party vendors.\n- NIST [Security and Privacy Controls for Information Systems and Organizations](https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final) publication (SP 800-53)."]]
