What Is SLSA?
Have you heard of SLSA?
Are you wondering what it is…
It’s not Salsa misspelled, SLSA, although it is pronounced Salsa, But it doesn’t go on your chips.
SLSA is a set of actionable and specific guidelines to take in order to improve your software supply chain security.
They are incrementally adoptable, offering levels from 0 to 4.
If you think of a food product, the “ingredient label” equivalent is the “software bill of materials” (SBOM) this tells you what is in your software.
In this analogy, SLSA can be thought of as all the food safety handling guidelines that help reduce contamination risk and make that ingredient list credible especially for those with allergies.
SLSA is useful for both software producers as guidelines to make software supply chain more secure, and consumers who can also use SLSA to evaluate the trustworthiness of the artifacts they consume
SLSA is also a way to measure your efforts toward compliance with the forthcoming Executive Order 14028 which indicates your development process must follow NIST Secure Software Development Framework (SSDF). Although following SLSA guidelines is not required nor will it make you fully SSDF it will however get you a large part of the way there. It is also broken up into easy to follow steps with clear guidance.
Hopefully that gives you an idea of what SLSA is
Photo by Tai's Captures on Unsplash
http://activestate.com/
https://slsa.dev/