Signed Supply Chain
A signed software supply chain
The scanning engine touches your network directly, so your team needs to be able to verify what runs inside it at any moment. Cyprob provides that through a signature chain.
How the chain works
Every check and every update package is signed with an ed25519 key. The installation does not execute content before the signature is verified. If a signature is placed on the revocation list, the content it covers stops working even when it was installed earlier. A version monotonicity check prevents an older, vulnerable release from being pushed in place of a newer one.
What signing is worth on a closed network
In an air-gapped installation updates are carried in by hand, and the chain of custody cannot guarantee that the file was not altered on the way. Signature verification covers that gap. Whatever route the file took, a package that fails verification is not installed.
Common questions
What happens to content whose signature is revoked?
It is disabled. Once a signature lands on the revocation list, that content stops running even if it was installed earlier.
Can an older version replace a newer one?
No. The version monotonicity check blocks a downgrade, so a known-vulnerable build cannot be slid in over a fixed one.
How do we know a hand-carried file was not altered?
By its signature. Every check and update package is signed with an ed25519 key, and a package that fails verification is never installed, whatever route it travelled.