◇ OpenCyber Academy
Rapid course · Chapter 4 · English

Chapter 4 — Application and software supply chain security: guided lab and applied synthesis

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 4 — Application and software supply chain security: guided lab and applied synthesis

Lesson map

Lesson 04 published. Map, example, EX039.

flowchart TD
  N0["Learning outcomes"]
  N1["4.1 The update"]
  N2["Lab — release checklist"]
  N3["4.2 Lab result"]
  N4["4.3 Why a checklist"]
  N5["4.4 Routines"]
  N6["4.5 Putting it together"]
  N7["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
  N7 --> EX["Worked example"]
  EX --> Q["Exercise EX039"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["4.1 The update"]
  N2["Lab — release checklist"]
  N3["4.2 Lab result"]
  N4["4.3 Why a checklist"]
  N5["4.4 Routines"]
  N6["4.5 Putting it together"]
  N7["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX039"]

[Learning outcomes]
    |
    v
[4.1 The update]
    |
    v
[Lab — release checklist]
    |
    v
[4.2 Lab result]
    |
    v
[4.3 Why a checklist]
    |
    v
[4.4 Routines]
    |
    v
[4.5 Putting it together]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX039]

Learning outcomes

You will (1) prepare a safe update with a pre-release checklist; (2) verify downloads; (3) complete the month's improvements; (4) set routines to keep the site safe.

4.1 The update

Owen prepares the donate-form update to 3.2.4. He downloads it from the plugin's official page, compares its SHA-256 hash with the one published by the vendor, takes a backup and tests it on staging with synthetic donations.

The hash comparison protects against a changed download: even if the official page were tampered with or the file damaged on the way, a different file gives a different hash. The test on staging with synthetic donations checks that the updated form still sends donors to the payment provider and records the donation correctly.

Lab — release checklist

"""Pre-release checklist for a synthetic site update (stdlib only)."""
import hashlib
download = b"synthetic donate-form 3.2.4 release"
vendor_hash = hashlib.sha256(b"synthetic donate-form 3.2.4 release").hexdigest()
checks = {
    "official source used": True,
    "hash matches vendor": hashlib.sha256(download).hexdigest() == vendor_hash,
    "backup taken": True,
    "tested on staging copy": True,
    "admin accounts use MFA": False,
}
for item, ok in checks.items():
    print(f"[{'x' if ok else ' '}] {item}")
missing = [k for k, ok in checks.items() if not ok]
print("READY" if not missing else f"NOT READY: {', '.join(missing)}")

Run with python3 lab_release.py. Verified output:

[x] official source used
[x] hash matches vendor
[x] backup taken
[x] tested on staging copy
[ ] admin accounts use MFA
NOT READY: admin accounts use MFA

4.2 Lab result

Four items pass: official source used, hash matches vendor, backup taken and tested on staging copy. One fails: admin accounts use MFA, because one volunteer administrator has not finished setting up multi-factor sign-in. The lab prints NOT READY: admin accounts use MFA. Owen holds the release until the volunteer completes setup the next morning, then reruns the checklist and releases.

The failed item is outside the update itself, which is why it belongs on the list. A newly updated form on a site where one administrator account still has only a password leaves the most powerful account as the easiest way in. Holding the release for one night costs little; the director had already been told the update was coming.

4.3 Why a checklist

A checklist makes sure nothing is skipped under time pressure. Each item links to an earlier lesson: sources and hashes protect integrity, backups and staging protect availability, multi-factor sign-in protects the administrator accounts that could change everything else. SLSA v1.0 and Sigstore (Newman et al., 2022) show how larger projects automate similar integrity checks.

For Owen, the list also replaces memory. He runs this release once, but the weekly routine will repeat the same steps for every update, sometimes in a hurry when an advisory is published. A written checklist means a second volunteer, who the director has asked to learn the routines, can follow the same steps without Owen there.

4.4 Routines

Weekly: check for plugin updates and apply security updates after staging. Monthly: review the component list and administrator accounts. Yearly: review maintenance of each component and the restore test. All are noted in the change log.

Each routine has an owner and a note. The weekly update check is Owen's, with the second volunteer as backup. The monthly account review would have caught the volunteer administrator who had not finished setting up multi-factor sign-in. The yearly maintenance review is where a component like event-calendar, quiet for years, would be spotted early.

4.5 Putting it together

By the end of the month: multi-factor sign-in for all administrators, a component inventory, donate-form updated, event-calendar replaced, photo-gallery removed, automatic security updates on, and written routines.

Each item has evidence in the change log or the inventory, which is what Owen showed the director and Nadia. The limits are written down too: he cannot check the payment provider's security, he relies on vendors publishing advisories, and he is one person. A second volunteer learning the routines is the answer to the last of these.

Worked example

Owen presents the month's work to the director and Nadia, opening the change-log entry or inventory row behind each result and reading out the three limits. The director agrees to ask a second volunteer to learn the routines so they continue if Owen is away.

Synthetic case. Components, checklists and outcomes are synthetic.

Errors and limits

A passed checklist means the known steps were done, not that the site is perfectly safe.

Exercises

Synthesis

Check before each release and keep simple routines going.

Continue studying — chapter 04 of 04

← Chapter 03 (draft) · Course chapter index · Worked results ↓ · Next course via chapter index →