Securing the Software Supply Chain

Following security processes and best practices as described in Chapter 6, Exploring Secure Development Processes for Automotive IoT, as well as performing automated application security testing by establishing a secure development platform as described in Chapter 7, Establishing a Secure Software Development Platform, will help organizations improve security with a focus on their in-house-developed software.

However, applications that support automotive Internet of Things (IoT) use cases typically encompass a wide variety of software, coming from numerous sources and provided through a so-called software supply chain. For example, a diagnostics application running on the vehicle may have parts of the software developed by the automaker and other parts of the software developed by a supplier. As part of the backend solution, open source software (OSS) frameworks and libraries may be used. These OSS components are generally developed and maintained...