{"id":126,"date":"2026-09-13T20:56:44","date_gmt":"2026-09-13T20:56:44","guid":{"rendered":"https:\/\/neranis.com\/?post_type=nrn_service&#038;p=126"},"modified":"2026-09-13T20:56:44","modified_gmt":"2026-09-13T20:56:44","slug":"la-dependance-et-la-securite-de-la-chaine-dapprovisionnement-des-logiciels-sca-sbom","status":"publish","type":"nrn_service","link":"https:\/\/neranis.com\/fr\/services\/dependency-and-software-supply-chain-security-sca-sbom\/","title":{"rendered":"S\u00e9curit\u00e9 des d\u00e9pendances et de la cha\u00eene d'approvisionnement logicielle \u2014 SCA\/SBOM"},"content":{"rendered":"<section class=\"wp-block-group nrn2-section nrn2-page-hero is-layout-flow wp-block-group-is-layout-flow\">\n<div class=\"wp-block-group nrn2-wrap is-layout-flow wp-block-group-is-layout-flow\">\n<p class=\"nrn2-breadcrumb wp-block-paragraph\"><a href=\"https:\/\/neranis.com\/fr\/\">Accueil<\/a> <span aria-hidden=\"true\">\/<\/span> <a href=\"https:\/\/neranis.com\/fr\/expertise\/\">Expertise<\/a> \/ <a href=\"https:\/\/neranis.com\/fr\/expertise\/securite-des-applications\/\">S\u00e9curit\u00e9 des applications<\/a><\/p>\n\n\n<div class=\"wp-block-group nrn2-service-top nrn2-hero-layout-r3 is-layout-flow wp-block-group-is-layout-flow\">\n<div class=\"wp-block-group nrn2-hero-split-copy is-layout-flow wp-block-group-is-layout-flow\">\n\n<p class=\"nrn2-kicker wp-block-paragraph\">APP \/ APP-04<\/p>\n\n\n<h1 class=\"wp-block-heading nrn2-title\">S\u00e9curit\u00e9 des d\u00e9pendances et de la cha\u00eene d'approvisionnement logicielle \u2014 SCA\/SBOM<\/h1>\n\n\n<p class=\"nrn2-lead wp-block-paragraph\">Conna\u00eetre les composants d'un produit logiciel et en ma\u00eetriser la provenance, les vuln\u00e9rabilit\u00e9s et les mises \u00e0 jour. Un SBOM d\u00e9crit les composants ; il doit \u00eatre utilis\u00e9 et tenu \u00e0 jour pour garantir la s\u00e9curit\u00e9.<\/p>\n\n<\/div>\n\n\n<figure class=\"wp-block-image size-full nrn2-context-image nrn2-visual-asset-service-family-app\"><img loading=\"lazy\" decoding=\"async\" width=\"1600\" height=\"500\" src=\"https:\/\/neranis.com\/wp-content\/uploads\/2026\/09\/service-family-app.webp\" alt=\"\" class=\"wp-image-250\" srcset=\"https:\/\/neranis.com\/wp-content\/uploads\/2026\/09\/service-family-app.webp 1600w, https:\/\/neranis.com\/wp-content\/uploads\/2026\/09\/service-family-app-300x94.webp 300w, https:\/\/neranis.com\/wp-content\/uploads\/2026\/09\/service-family-app-1024x320.webp 1024w, https:\/\/neranis.com\/wp-content\/uploads\/2026\/09\/service-family-app-768x240.webp 768w, https:\/\/neranis.com\/wp-content\/uploads\/2026\/09\/service-family-app-1536x480.webp 1536w\" sizes=\"auto, (max-width: 1600px) 100vw, 1600px\" \/><\/figure>\n<\/div>\n<\/div>\n\n<\/section>\n\n\n<section class=\"wp-block-group nrn2-section is-layout-flow wp-block-group-is-layout-flow\">\n<div class=\"wp-block-group nrn2-wrap is-layout-flow wp-block-group-is-layout-flow\">\n<div class=\"wp-block-group nrn2-service-top is-layout-flow wp-block-group-is-layout-flow\">\n<div class=\"wp-block-group nrn2-service-intro is-layout-flow wp-block-group-is-layout-flow\">\n<p class=\"nrn2-kicker wp-block-paragraph\">QUAND C'EST UTILE<\/p>\n\n\n<h2 class=\"wp-block-heading nrn2-h2\">Une r\u00e9ponse cibl\u00e9e<br>\u00e0 un besoin d\u00e9fini.<\/h2>\n\n\n<p class=\"nrn2-body-lg wp-block-paragraph\">De nombreuses d\u00e9pendances open source, la demande des clients concernant un cahier des charges logiciel, un incident chez le fournisseur ou l\u2019impossibilit\u00e9 d\u2019identifier les produits gr\u00e2ce \u00e0 un composant vuln\u00e9rable.<\/p>\n\n\n<div class=\"wp-block-buttons nrn2-buttons is-layout-flex wp-block-buttons-is-layout-flex\">\n<div class=\"wp-block-button\"><a class=\"wp-block-button__link wp-element-button\" href=\"https:\/\/neranis.com\/fr\/contact\/\">Discutez de ce service<\/a><\/div>\n\n<\/div>\n\n<\/div>\n\n\n<div class=\"wp-block-group nrn2-facts is-layout-flow wp-block-group-is-layout-flow\">\n<p class=\"nrn2-kicker wp-block-paragraph\">EN UN COUP D'\u0152IL<\/p>\n\n\n<p class=\"wp-block-paragraph\"><strong>Famille<\/strong><br><a href=\"https:\/\/neranis.com\/fr\/expertise\/securite-des-applications\/\">S\u00e9curit\u00e9 des applications<\/a><\/p>\n\n\n<p class=\"wp-block-paragraph\"><strong>Engagement<\/strong><br>Conseil et mise en \u0153uvre<\/p>\n\n\n<p class=\"wp-block-paragraph\"><strong>R\u00e9f\u00e9rence<\/strong><br>APP-04<\/p>\n\n<\/div>\n\n<\/div>\n\n<\/div>\n\n<\/section>\n\n\n<section class=\"wp-block-group nrn2-section nrn2-canvas is-layout-flow wp-block-group-is-layout-flow\">\n<div class=\"wp-block-group nrn2-wrap is-layout-flow wp-block-group-is-layout-flow\">\n<div class=\"wp-block-group nrn2-section-heading is-layout-flow wp-block-group-is-layout-flow\">\n<div class=\"wp-block-group is-layout-flow wp-block-group-is-layout-flow\">\n<p class=\"nrn2-kicker wp-block-paragraph\">PORT\u00c9E ET R\u00c9SULTATS<\/p>\n\n\n<h2 class=\"wp-block-heading nrn2-h2\">Ce que couvre la mission.<\/h2>\n\n<\/div>\n\n<\/div>\n\n\n<div class=\"wp-block-group nrn2-delivery-grid is-layout-flow wp-block-group-is-layout-flow\">\n<div class=\"wp-block-group nrn2-delivery-card is-layout-flow wp-block-group-is-layout-flow\">\n<h3 class=\"wp-block-heading\">Port\u00e9e<\/h3>\n\n\n<ul class=\"wp-block-list nrn2-list\">\n<li>Inventaire des composants<\/li>\n\n\n<li>d\u00e9pendances directes\/transitives<\/li>\n\n\n<li>SBOM<\/li>\n\n\n<li>analyse de la vuln\u00e9rabilit\u00e9<\/li>\n\n\n<li>provenance de l'objet d'art<\/li>\n\n\n<li>signatures lorsque c'est n\u00e9cessaire<\/li>\n\n\n<li>mises \u00e0 jour<\/li>\n\n\n<li>Traitement des exceptions<\/li>\n\n<\/ul>\n\n<\/div>\n\n\n<div class=\"wp-block-group nrn2-delivery-card is-layout-flow wp-block-group-is-layout-flow\">\n<h3 class=\"wp-block-heading\">Livrables<\/h3>\n\n\n<ul class=\"wp-block-list nrn2-list\">\n<li>SBOM li\u00e9 \u00e0 la version<\/li>\n\n\n<li>Registre des d\u00e9pendances<\/li>\n\n\n<li>Priorisation contextuelle<\/li>\n\n\n<li>Politique de provenance<\/li>\n\n\n<li>Processus de mise \u00e0 jour<\/li>\n\n\n<li>preuves de v\u00e9rification et limites de couverture<\/li>\n\n<\/ul>\n\n<\/div>\n\n\n<div class=\"wp-block-group nrn2-delivery-card nrn2-evidence is-layout-flow wp-block-group-is-layout-flow\">\n<h3 class=\"wp-block-heading\">Preuve de r\u00e9ception<\/h3>\n\n\n<p class=\"wp-block-paragraph\">Le SBOM de la version cible est reproduisable ; les composants critiques sont identifi\u00e9s ; un alertes d\u2019essai est li\u00e9 aux produits concern\u00e9s ; les processus de mise \u00e0 jour et d\u2019exception fonctionnent.<\/p>\n\n<\/div>\n\n<\/div>\n\n<\/div>\n\n<\/section>\n\n\n<section class=\"wp-block-group nrn2-section is-layout-flow wp-block-group-is-layout-flow\">\n<div class=\"wp-block-group nrn2-wrap is-layout-flow wp-block-group-is-layout-flow\">\n<div class=\"wp-block-group nrn2-section-heading is-layout-flow wp-block-group-is-layout-flow\">\n<div class=\"wp-block-group is-layout-flow wp-block-group-is-layout-flow\">\n<p class=\"nrn2-kicker wp-block-paragraph\">LIVRAISON<\/p>\n\n\n<h2 class=\"wp-block-heading nrn2-h2\">Comment le travail est structur\u00e9.<\/h2>\n\n<\/div>\n\n<\/div>\n\n\n<div class=\"wp-block-group nrn2-two-col is-layout-flow wp-block-group-is-layout-flow\">\n<div class=\"wp-block-group nrn2-prose is-layout-flow wp-block-group-is-layout-flow\">\n<h3 class=\"wp-block-heading\">Approche<\/h3>\n\n\n<p class=\"wp-block-paragraph\">Comprendre l\u2019architecture ; s\u00e9lectionner les risques et les exigences ; int\u00e9grer ou v\u00e9rifier les contr\u00f4les ; tester ; les transmettre aux \u00e9quipes et planifier des contr\u00f4les de r\u00e9gression.<\/p>\n\n\n<h3 class=\"wp-block-heading\">Pr\u00e9requis et responsabilit\u00e9s<\/h3>\n\n\n<p class=\"wp-block-paragraph\">Client : code, architecture, d\u00e9veloppeurs, environnement de test et acc\u00e8s au pipeline. Fournisseur : expertise et contr\u00f4les ; correction du code uniquement lorsqu'elle est incluse.<\/p>\n\n<\/div>\n\n\n<div class=\"wp-block-group nrn2-prose is-layout-flow wp-block-group-is-layout-flow\">\n<h3 class=\"wp-block-heading\">Facteurs de port\u00e9e<\/h3>\n\n\n<p class=\"wp-block-paragraph\">Applications, langages, r\u00e9f\u00e9rentiels, d\u00e9pendances, r\u00f4les, pipelines, volume et profondeur. S\u00e9parer les licences d'outils, le d\u00e9veloppement de rem\u00e9diation et la maintenance.<\/p>\n\n\n<h3 class=\"wp-block-heading\">Questions \u00e0 clarifier<\/h3>\n\n\n<p class=\"wp-block-paragraph\">Les composants de chaque version peuvent-ils \u00eatre reconstitu\u00e9s ? Qui surveille les vuln\u00e9rabilit\u00e9s apr\u00e8s la sortie de la version ? Les d\u00e9pendances dans les images et les fichiers binaires sont-elles visibles ?<\/p>\n\n<\/div>\n\n<\/div>\n\n<\/div>\n\n<\/section>\n\n\n<section class=\"wp-block-group nrn2-section nrn2-compact is-layout-flow wp-block-group-is-layout-flow\">\n<div class=\"wp-block-group nrn2-wrap is-layout-flow wp-block-group-is-layout-flow\">\n<div class=\"wp-block-group nrn2-boundaries is-layout-flow wp-block-group-is-layout-flow\">\n<p class=\"nrn2-kicker wp-block-paragraph\">LIMITES IMPORTANTES<\/p>\n\n\n<p class=\"nrn2-body-lg wp-block-paragraph\">La pr\u00e9sence d\u2019un composant vuln\u00e9rable ne prouve pas toujours qu\u2019il peut \u00eatre exploit\u00e9, et l\u2019absence d\u2019un SBOM complet ne signifie pas n\u00e9cessairement qu\u2019il n\u2019est pas utilis\u00e9. La licence logicielle n\u00e9cessite une analyse distincte.<\/p>\n\n\n<p class=\"wp-block-paragraph\">Les contr\u00f4les s'appliquent aux versions et au p\u00e9rim\u00e8tre convenus. Aucun scanner, SBOM ou framework ne garantit \u00e0 lui seul la s\u00e9curit\u00e9 du logiciel livr\u00e9.<\/p>\n\n<\/div>\n\n<\/div>\n\n<\/section>\n\n\n<section class=\"wp-block-group nrn2-section is-layout-flow wp-block-group-is-layout-flow\">\n<div class=\"wp-block-group nrn2-wrap is-layout-flow wp-block-group-is-layout-flow\">\n<div class=\"wp-block-group nrn2-section-heading is-layout-flow wp-block-group-is-layout-flow\">\n<div class=\"wp-block-group is-layout-flow wp-block-group-is-layout-flow\">\n<p class=\"nrn2-kicker wp-block-paragraph\">EN PRATIQUE<\/p>\n\n\n<h2 class=\"wp-block-heading nrn2-h2\">Situations illustratives.<\/h2>\n\n<\/div>\n\n\n<p class=\"nrn2-section-lead wp-block-paragraph\">Ces exemples d\u00e9crivent des engagements possibles et des r\u00e9sultats cibles. Il ne s'agit pas de r\u00e9f\u00e9rences clients ni de r\u00e9sultats obtenus.<\/p>\n\n<\/div>\n\n\n<details class=\"wp-block-details nrn2-details is-layout-flow wp-block-details-is-layout-flow\"><summary>Sc\u00e9nario 01<\/summary>\n<p class=\"wp-block-paragraph\">Un fournisseur re\u00e7oit un alertes concernant une biblioth\u00e8que commune. Projet : associer les SBOM aux versions livr\u00e9es et \u00e9valuer l\u2019exposition. Objectif : une liste de produits justifi\u00e9e \u00e0 corriger plut\u00f4t qu\u2019une r\u00e9action uniforme dans tout le catalogue.<\/p>\n\n<\/details>\n\n\n<details class=\"wp-block-details nrn2-details is-layout-flow wp-block-details-is-layout-flow\"><summary>Sc\u00e9nario 02<\/summary>\n<p class=\"wp-block-paragraph\">Un client demande des SBOM aux fournisseurs. Projet : d\u00e9finir le format, la version et l\u2019utilisation des r\u00e9sultats. Objectif : des informations exploitables ; les SBOM incomplets ou p\u00e9rim\u00e9s sont signal\u00e9s plut\u00f4t que trait\u00e9s comme des garanties.<\/p>\n\n<\/details>\n\n\n<details class=\"wp-block-details nrn2-details is-layout-flow wp-block-details-is-layout-flow\"><summary>Contexte technologique et de r\u00e9f\u00e9rence<\/summary>\n<p class=\"wp-block-paragraph\">Exemples : outils SCA\/SBOM et de v\u00e9rification de la provenance ; pratiques de l\u2019SSDF du NIST, avec des formats et des int\u00e9grations d\u00e9finis lors de la phase de cadrage.<\/p>\n\n\n<p class=\"wp-block-paragraph\">L'ensemble final des technologies est convenu lors du cadrage, sur la base de l'interop\u00e9rabilit\u00e9, des licences, des droits d'acc\u00e8s et des exigences op\u00e9rationnelles.<\/p>\n\n<\/details>\n\n<\/div>\n\n<\/section>\n\n\n<section class=\"wp-block-group nrn2-section is-layout-flow wp-block-group-is-layout-flow\">\n<div class=\"wp-block-group nrn2-wrap is-layout-flow wp-block-group-is-layout-flow\">\n<div class=\"wp-block-group nrn2-section-heading is-layout-flow wp-block-group-is-layout-flow\">\n<div class=\"wp-block-group is-layout-flow wp-block-group-is-layout-flow\">\n<p class=\"nrn2-kicker wp-block-paragraph\">SERVICES CONNECT\u00c9S<\/p>\n\n\n<h2 class=\"wp-block-heading nrn2-h2\">Construisez l'\u00e9tape suivante.<\/h2>\n\n<\/div>\n\n\n<p class=\"nrn2-section-lead wp-block-paragraph\">Ces services peuvent compl\u00e9ter la mission. Ils ne sont pas inclus automatiquement.<\/p>\n\n<\/div>\n\n\n<div class=\"wp-block-group nrn2-related-grid is-layout-flow wp-block-group-is-layout-flow\">\n<div class=\"wp-block-group nrn2-service-card is-layout-flow wp-block-group-is-layout-flow\">\n<p class=\"nrn2-ref wp-block-paragraph\">PEN-03<\/p>\n\n\n<h3 class=\"wp-block-heading\"><a href=\"https:\/\/neranis.com\/fr\/services\/web-application-penetration-testing\/\">Test d'intrusion d'applications web<\/a><\/h3>\n\n\n<p class=\"nrn2-card-desc wp-block-paragraph\">Tester les applications bas\u00e9es sur navigateur pour d\u00e9tecter les failles, en particulier au niveau de l'authentification, de l'autorisation et des flux de travail m\u00e9tier.<\/p>\n\n\n<p class=\"nrn2-text-link wp-block-paragraph\"><a href=\"https:\/\/neranis.com\/fr\/services\/web-application-penetration-testing\/\">D\u00e9couvrir ce service <span aria-hidden=\"true\">\u2197<\/span><\/a><\/p>\n\n<\/div>\n\n\n<div class=\"wp-block-group nrn2-service-card is-layout-flow wp-block-group-is-layout-flow\">\n<p class=\"nrn2-ref wp-block-paragraph\">APP-03<\/p>\n\n\n<h3 class=\"wp-block-heading\"><a href=\"https:\/\/neranis.com\/fr\/services\/ci-cd-integration-de-la-securite-et-du-devsecops\/\">S\u00e9curit\u00e9 CI\/CD et int\u00e9gration DevSecOps<\/a><\/h3>\n\n\n<p class=\"nrn2-card-desc wp-block-paragraph\">Int\u00e9grer des contr\u00f4les de s\u00e9curit\u00e9 dans le d\u00e9veloppement et le d\u00e9ploiement avec des r\u00e8gles de blocage et d'exception compr\u00e9hensibles. Le projet prot\u00e8ge \u00e9galement la cha\u00eene de livraison des logiciels elle-m\u00eame : comptes, ex\u00e9cuteurs, secrets et autorisations.<\/p>\n\n\n<p class=\"nrn2-text-link wp-block-paragraph\"><a href=\"https:\/\/neranis.com\/fr\/services\/ci-cd-integration-de-la-securite-et-du-devsecops\/\">D\u00e9couvrir ce service <span aria-hidden=\"true\">\u2197<\/span><\/a><\/p>\n\n<\/div>\n\n\n<div class=\"wp-block-group nrn2-service-card is-layout-flow wp-block-group-is-layout-flow\">\n<p class=\"nrn2-ref wp-block-paragraph\">REM-06<\/p>\n\n\n<h3 class=\"wp-block-heading\"><a href=\"https:\/\/neranis.com\/fr\/services\/reexamen-des-resultats-et-validation-de-la-fermeture\/\">Tests de rem\u00e9diation et validation de la cl\u00f4ture<\/a><\/h3>\n\n\n<p class=\"nrn2-card-desc wp-block-paragraph\">V\u00e9rification cibl\u00e9e confirmant que les vuln\u00e9rabilit\u00e9s ou lacunes identifi\u00e9es ont \u00e9t\u00e9 corrig\u00e9es, tout en maintenanat un lien clair avec la constatation d'origine.<\/p>\n\n\n<p class=\"nrn2-text-link wp-block-paragraph\"><a href=\"https:\/\/neranis.com\/fr\/services\/reexamen-des-resultats-et-validation-de-la-fermeture\/\">D\u00e9couvrir ce service <span aria-hidden=\"true\">\u2197<\/span><\/a><\/p>\n\n<\/div>\n\n<\/div>\n\n<\/div>\n\n<\/section>\n\n\n<section class=\"wp-block-group nrn2-section is-layout-flow wp-block-group-is-layout-flow\">\n<div class=\"wp-block-group nrn2-wrap is-layout-flow wp-block-group-is-layout-flow\">\n<div class=\"wp-block-group nrn2-cta is-layout-flow wp-block-group-is-layout-flow\">\n<div class=\"wp-block-group is-layout-flow wp-block-group-is-layout-flow\">\n<p class=\"nrn2-kicker wp-block-paragraph\">Commencer une conversation<\/p>\n\n\n<h2 class=\"wp-block-heading nrn2-h2\">Clarifiez la port\u00e9e.<\/h2>\n\n<\/div>\n\n\n<div class=\"wp-block-group is-layout-flow wp-block-group-is-layout-flow\">\n<p class=\"nrn2-body-lg wp-block-paragraph\">Nous clarifierons l'objectif, les d\u00e9pendances et les responsabilit\u00e9s de ce service avant de proposer la livraison.<\/p>\n\n\n<div class=\"wp-block-buttons nrn2-buttons is-layout-flex wp-block-buttons-is-layout-flex\">\n<div class=\"wp-block-button\"><a class=\"wp-block-button__link wp-element-button\" href=\"https:\/\/neranis.com\/fr\/contact\/\">Discutez de vos priorit\u00e9s<\/a><\/div>\n\n<\/div>\n\n<\/div>\n\n<\/div>\n\n<\/div>\n\n<\/section>","protected":false},"excerpt":{"rendered":"<p>Conna\u00eetre les composants d'un produit logiciel et en ma\u00eetriser la provenance, les vuln\u00e9rabilit\u00e9s et les mises \u00e0 jour. Un SBOM d\u00e9crit les composants ; il doit \u00eatre utilis\u00e9 et tenu \u00e0 jour pour garantir la s\u00e9curit\u00e9.<\/p>","protected":false},"featured_media":0,"template":"single-nrn_service","meta":{"footnotes":""},"nrn_family":[14],"class_list":["post-126","nrn_service","type-nrn_service","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/neranis.com\/fr\/wp-json\/wp\/v2\/nrn_service\/126","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/neranis.com\/fr\/wp-json\/wp\/v2\/nrn_service"}],"about":[{"href":"https:\/\/neranis.com\/fr\/wp-json\/wp\/v2\/types\/nrn_service"}],"version-history":[{"count":2,"href":"https:\/\/neranis.com\/fr\/wp-json\/wp\/v2\/nrn_service\/126\/revisions"}],"predecessor-version":[{"id":521,"href":"https:\/\/neranis.com\/fr\/wp-json\/wp\/v2\/nrn_service\/126\/revisions\/521"}],"wp:attachment":[{"href":"https:\/\/neranis.com\/fr\/wp-json\/wp\/v2\/media?parent=126"}],"wp:term":[{"taxonomy":"nrn_family","embeddable":true,"href":"https:\/\/neranis.com\/fr\/wp-json\/wp\/v2\/nrn_family?post=126"}],"curies":[{"name":"Bien jou\u00e9","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}