Guides and Field Guides / Cybersecurity Field Guides
Software and AI Supply-Chain Security
A software and AI supply-chain guide covering source, dependencies, build systems, CI/CD, provenance, signing, SBOMs, VEX, model and dataset lineage, release, distribution, updates, suppliers, validation, incident response, and governed automation.
Publication record
MYTHOS-FG-SEC-0014
- Publication class
- Focused Field Guide
- Status
- Candidate
- Revision
- 1.0.0-candidate
- Pages
- 56
- Authority validated
- Sep 17, 2026
- Review or expiration
- Oct 26, 2026
- File size
- 241 KB
Reader
Read the publication
Searchable, bookmarked PDF, 56 pages. Loads on request (241 KB).
Candidate status describes publication review state. It does not establish certification, legal compliance, implementation conformance, benchmark reproduction, or product readiness.
Related
More in Cybersecurity Field Guides
MYTHOS-FG-SEC-0001 Threat Modeling and Security Architecture
A system-level threat-modeling and security-architecture guide covering assets, data flows, trust boundaries, actors, attack surfaces, abuse cases, STRIDE-style analysis, attack trees, adversary behavior, control selection, residual risk, architecture review, verification, and living-model governance.
MYTHOS-FG-SEC-0002 Zero-Trust Architecture and Continuous Authorization
A zero-trust engineering guide covering policy decision and enforcement, identity, devices, workloads, networks, applications, data, telemetry, continuous evaluation, microsegmentation, SASE, service identity, hybrid cloud, failure design, migration, maturity, and operational assurance.
MYTHOS-FG-SEC-0003 Enterprise Firewall Engineering and Policy Architecture
A vendor-neutral enterprise firewall guide covering packet flow, sessions, zones, policy evaluation, objects, NAT, application and identity controls, TLS inspection, clustering, routing, virtual systems, cloud enforcement, policy lifecycle, automation, telemetry, performance, troubleshooting, and blast-radius control.
MYTHOS-FG-SEC-0004 IPsec, TLS VPN, Remote Access, and Tunnel Troubleshooting
A tunnel and remote-access guide covering IPsec architecture, IKEv2, ESP, SAs, traffic selectors, NAT traversal, certificates, routing, policy, TLS VPN, client posture, split tunneling, clustering, mobility, MTU, observability, packet troubleshooting, and hybrid post-quantum transition.
MYTHOS-FG-SEC-0005 Microsegmentation, Workload Isolation, and East-West Security
A microsegmentation guide covering workload identity, policy models, distributed enforcement, host and hypervisor controls, Kubernetes network policy, service mesh, east-west traffic, dependencies, brownfield adoption, policy testing, observability, failure containment, and zero-trust integration.
MYTHOS-FG-SEC-0006 Identity, Access, PKI, Secrets, and Privileged Access Engineering
An identity-security engineering guide covering proofing, directories, authentication, passkeys, federation, OAuth and OIDC, authorization, PKI, certificates, workload identity, secrets, key management, privileged access, non-human and agent identity, lifecycle, recovery, monitoring, and post-quantum readiness.