✳ Learning path / 4 lessons
Application & software supply-chain security
Four intermediate lessons trace software security from whiteboard to runtime: STRIDE threat modeling across Data Flow Diagram trust boundaries, locking direct and transitive dependency trees, separating untrusted PR execution from signed production promotion in CI/CD, and binding SBOM inventories to running build digests.
Work through the lessons in order to build a complete engineering mental model, or jump straight to the topic you are designing or reviewing today.
NIST SSDF Version 1.1 is a shared practice vocabulary on its explainer page. An SBOM is inventory evidence, not SSDF done.
01Threat modeling a service: data flows, trust boundaries, and STRIDE
Before writing code or buying scanners, map how data crosses trust boundaries and apply STRIDE to uncover design flaws while architecture is still cheap to change.
Direct and transitive dependencies: inherited code in your runtime
Importing a single package pulls an entire tree of transitive dependencies into your build and runtime privilege boundary. Learn how lockfiles, hashes, and reachability govern supply-chain risk.
CI/CD trust boundaries: writing code vs promoting to production
A pull request from a developer laptop is untrusted input until reviewed, built in an isolated runner, and cryptographically attested. Separate source write access from production promotion.
SBOM evidence and priority: binding inventory to the running build
A Software Bill of Materials (SBOM) is only useful when cryptographically bound to the exact artifact running in production. Separate advisory matching, build evidence, and owner decisions from deployed fixes.
Test your engineering judgment
Every lesson closes with a 4-choice scenario check modeled on real architectural trade-offs. Ready for full hands-on simulations or certification drills?
Open the practice labs ↗ · Launch the CISSP practice simulator ↗