４ 参考文献
| [1] | Department of Defense, "DoD Enterprise DevSecOps Reference Design,": |
|---|---|
| [2] | JFrog, “What is a Software Artifact?,” JFrog: https://jfrog.com/devops-tools/article/what-is-a-software-artifact/ |
| [3] | Red Hat Software, “What is CI/CD?,”: |
| [4] | デジタル庁デジタル社会推進会議幹事会, “政府情報システムにおけるクラウドサービスの適切な利用に係る基本方針,”: |
| [5] | 内閣サイバーセキュリティセンター, “政府機関等のサイバーセキュリティ対策のための統一基準群,”: |
| [6] | MDN Web Docs, “MDN Web Docs 用語集: ウェブ関連用語の定義,”: |
| [7] | Trevor Rosen, SolarWinds, Keynote: Project Trebuchet: How SolarWinds is Using Open Source to Secure Their Supply Chain, KubeCon + CloudNative Con Europe 2022: https://www.youtube.com/watch?v=1-tMRxqMwTQ |
| [8] | K. Zetter, “The Untold Story of the Boldest Supply-Chain Hack Ever,”: https://www.wired.com/story/the-untold-story-of-solarwinds-the-boldest-supply-chain-hack-ever/ |
| [9] | “ゼロトラストアーキテクチャ適用方針,”: |
| [10] | GitHub, “GitHub glossary,” GitHub,: https://docs.github.com/en/get-started/learning-about-github/github-glossary |
| [11] | GitHub, Inc., “About authentication with SAML single sign-on,”: |
| [12] | National Security Agency, Cybersecurity and Infrastructure Security Agency, “Defending Continuous Integration/Continuous Delivery (CI/CD) Environments,” https://media.defense.gov/2023/Jun/28/2003249466/-1/-1/0/CSI_DEFENDING_CI_CD_ENVIRONMENTS.PDF |
| [13] | National Institute of Standards and Technology, “NIST SP800-204D Strategies for the Integration of Software Supply Chain Security in DevSecOps CI/CD Pipelines,”: |
| [14] | Cybersecurity and Infrastructure Security Agency, “Securing The Software Supply Chain: Recommended Practices Guide for Developers,”: |
| [15] | SLSA, “Safeguarding artifact integrity across any software supply chain,”: |
| [16] | Cider Security Ltd., “Top 10 CI/CD Security Risks,”: |
| [17] | 経済産業省 商務情報政策局 サイバーセキュリティ課, “OSS の利活⽤及びそのセキュリティ確保に向けた 管理⼿法に関する事例集,” https://www.meti.go.jp/policy/netsecurity/wg1/ossjirei_20220801.pdf |