DigiCert Adds Secure Releases to Software Trust Manager to Manage Risk Before and After Software Ships

New functionality connects software bills of materials (SBOMs) and vulnerability findings with signing controls to help teams identify affected versions and enforce release policies

DigiCert, a global leader in intelligent trust, announced Secure Releases, new functionality in DigiCert Software Trust Manager that helps organizations assess software risk when a release ships and as new vulnerabilities emerge. Part of the DigiCert ONE platform, it brings together information about supported GitHub releases, their software bills of materials (SBOMs), known vulnerabilities, severity, and security scan results. Teams can identify which versions need attention and use that information in their signing and release workflows.

Signing confirms who produced software and whether it has been altered, but a component can become vulnerable after the software ships. Finding the affected versions can mean piecing together information from repositories, SBOMs, vulnerability databases, and security scanners. Secure Releases brings that information together by release so teams can see what needs attention and act on it.
With Software Trust Manager, including Secure Releases, organizations can:

·Sign software and cryptographic inventories. Sign software bills of materials (SBOMs) and cryptographic bills of materials (CBOMs) so recipients can verify their source and integrity.

·See and monitor release risk. View dependencies, SBOMs, vulnerabilities, severity, and supported scan results for each release, and identify new risks as vulnerability information changes.

·Find and address affected releases. See which releases contain a vulnerable component, alert the teams responsible, and, with Premium, find a version of that component that fixes the vulnerability when one is available.

·Apply release policies. Set vulnerability and SBOM requirements and, where supported, prevent signing or release when those requirements are not met.

·Share evidence. Sign security evaluations, VEX statements, SLSA attestations, and SARIF reports for customers and auditors.

Also Read: CIO Influence Interview with John Elliott, Cybersecurity Author Fellow at Pluralsight

“Software signing proves where code came from and whether it has been altered, but those assurances do not tell teams whether a release contains a newly discovered vulnerability dependency,” said Deepika Chauhan, Chief Product Officer at DigiCert. “Secure Releases brings those pieces together. By connecting release risk to the same policies that govern signing and delivery, organizations can respond faster when exposure changes and keep software from moving forward when it does not meet their requirements.”

Secure Releases is available through Software Trust Manager Essentials, Advanced, and Premium. Essentials provides a point-in-time assessment of release risk. Advanced and Premium add ongoing monitoring of SBOM results by release as vulnerability information changes. Premium also suggests a newer version of a vulnerable component when a fix is available and lets organizations block signing or release if the software does not meet their security requirements.