Summary
This chapter expanded on the discussion from previous chapters, which explained high-level security processes (Chapter 6, Exploring Secure Development Processes for Automotive IoT) and provided practical guidance on establishing a secure development platform (Chapter 7, Establishing a Secure Software Development Platform), to also consider security in the software supply chain.
In particular, this chapter gave an overview of the software supply chain and distributed development in the automotive industry. Moreover, we reviewed specific approaches to defining responsibilities for cybersecurity activities between procurers and suppliers using a RASIC table. We also covered how organizations can evaluate their suppliers using a vendor security assessment approach and then, after selecting a vendor, establish a common understanding and agreement with suppliers on expectations for cybersecurity using a CIAD.
This chapter then presented how to manage risks when using OSS components...