HARDWARE.md
September 9, 2023 ยท View on GitHub
The Software Supply Chain Stages
| People | Local Reqs | Source Code | Integration | Deployment | Runtime | Hardware | DNS | Services | Cloud |
|---|---|---|---|---|---|---|---|---|---|
| Developers | IDE | Languages | SCM providers | Build solutions | Servers | Embedded PC | URL | SaaS solutions | CDN |
| QA team | SCV | Frameworks | Pull requests | Deployment platforms | Operating systems | PCB | hostname | Third party APIs | Cloud services |
| DevOps team | Local tests | Libraries | Secrets mgmt | Releases | Webservers | USB dongle | Payment gateways | ||
| Package Maintainers | Git repos | Package Managers | Git repos | Functional tests | Application servers | GPU/CPU | Identity Providers | ||
| Page Builders | Packages | Security tests | Web engines | Analytics | |||||
| Open source | API test frameworks | Databases | Proxies | ||||||
| Proprietary Code | Unit tests | ||||||||
| People | Local Reqs | Source Code | Integration | Deployment | Runtime | Hardware | DNS | Services | Cloud |
Hardware
This includes any specific or customized piece of hardware for this application to run.
What's in scope?
- Proprietary devices
- Dedicated servers
Examples
Embedded devices, custom PCBs, GPUs
Who owns it?
- Operations team
- Cloud provider
What are the security concerns?
- Hardware devices come with embedded software that is an attack vector
- Theft of small portable devices like USB keys
- Modification of the devices by malicious actors
How do I secure it?
- Buy from known supplier
- Network analysis so you can detect malicious "phone home"
- Physical isolation and/or network segmentation