Latest / Cybersecurity Under Pressure. Real Attacks, Real Lessons
Software Supply Chain Provenance: Beyond the Version Number | CUP Micro Brief
A component name and version do not prove provenance. This CUP Micro Brief explains how pedigree, cryptographic hashes and a verifiable chain of custody can help identify tampered code before it enters the build.
Related CUP episodes:
NIST IR 8536: Verifying the Software Supply Chain
SBOM and VEX: Turning Vulnerability Data into OT Risk Decisions
SBOM and VEX: Challenging Supplier Vulnerability Claims
Security Scanner Supply Chains: The Trivy and CERT-EU Case
The skinny
The skinny isn't ready yet — notes appear once the transcript is processed.