Secure Open Software Development, SBOMs & DevSecOps Training by Tonex
Open submarine software architectures depend on code and dependencies that may be produced by several organizations across different lifecycle stages. This course covers secure software development, Software Bills of Materials (SBOMs), and Development, Security, and Operations (DevSecOps) practices for modular embedded systems. Participants examine threat-informed requirements, dependency provenance, controlled builds, secure review, vulnerability prioritization, release integrity, and supplier coordination. Special attention is given to adapting continuous delivery concepts to restricted, offline, and high-assurance naval environments where releases may require formal configuration approval.
Cybersecurity controls must protect both delivered software and the process that creates it. Provenance tracking, vulnerability management, and controlled release pipelines strengthen cybersecurity against compromised dependencies and unauthorized modifications.
The practical training approach includes exercises, real-world case studies, and examples of processes and documentation used in submarine software engineering projects, including secure development standards, SBOM records, vulnerability disposition logs, and signed release approval documentation.
Learning Objectives
- Establish secure development requirements for submarine software components
- Create and interpret useful software component and dependency inventories
- Evaluate secure build, code review, and controlled release processes
- Prioritize vulnerabilities using exposure and engineering consequence
- Adapt DevSecOps practices to restricted deployment and assurance obligations
- Document cybersecurity supply chain evidence for supplier and program reviews
Audience
- Secure Software Engineers
- DevSecOps Practitioners
- Embedded Application Developers
- Software Supply Chain Analysts
- Submarine Platform Security Leads
- Release and Configuration Managers
- Cybersecurity Professionals
- Software Assurance Specialists
Course Modules
Module 1: Secure Software Lifecycle and Architecture Requirements
- Integrate threat analysis into modular application requirements and design
- Define coding rules and secure interface development expectations
- Identify critical assets, trust boundaries, and privileged processing responsibilities
- Allocate security verification ownership across development suppliers
- Establish security acceptance criteria for software and related services
- Connect secure lifecycle practices to high-assurance naval configuration governance
Module 2: Software Bill of Materials and Provenance
- Explain software component inventories and dependency relationship recording
- Identify direct, transitive, and bundled third-party software components
- Evaluate completeness and quality of supplier-provided SBOM records
- Review licensing, origin, version, and provenance documentation requirements
- Track component changes through application release and hardware refresh cycles
- Establish procedures for correcting inaccurate or missing dependency inventory data
Module 3: Secure Development and Build Integrity Controls
- Apply code review criteria to input handling and authorization logic
- Evaluate static analysis findings and relevant secure coding conventions
- Protect source repositories, build credentials, and integration artifacts
- Review reproducible build expectations and controlled compiler configurations
- Assess artifact signing and tamper-evident release record requirements
- Define separation of duties for building, approving, and publishing software
Module 4: Vulnerability Analysis and Remediation Decisions
- Correlate known component vulnerabilities with actual deployment exposure
- Separate vulnerability severity from mission-specific engineering consequence
- Plan remediation when upstream software support or fixes are unavailable
- Track mitigation ownership, risk acceptance, and patch verification evidence
- Review coordinated vulnerability disclosure and supplier notification responsibilities
- Preserve defensible records for deferred or compensating security measures
Module 5: DevSecOps in Controlled Naval Environments
- Differentiate automated development checks from unrestricted operational deployment
- Adapt pipeline workflows for offline networks and restricted repositories
- Maintain approved build environments and traceable integration test outputs
- Coordinate release cadence with system integration and assurance milestones
- Establish software update rollback and recovery approval requirements
- Document configuration integrity throughout staged sustainment and modernization
Module 6: Software Supply Chain Assurance and Reporting
- Evaluate developer and supplier security controls before component acceptance
- Review incident response responsibilities for compromised code or dependencies
- Assess protected update delivery and software distribution paths
- Identify privileged service exposure introduced by new development tools
- Connect SBOM findings to secure architecture and operational risk reviews
- Prepare cybersecurity evidence summaries for technical acceptance decisions
Improve confidence in submarine software provenance, secure releases, and supplier accountability. Secure Open Software Development, SBOMs & DevSecOps Training by Tonex supports professional engineering and cybersecurity decisions across complex modular submarine programs. Register with Tonex to strengthen your technical capabilities.