Skip to content

Security

Indian Hill Labs treats software assurance as a lifecycle: reduce unnecessary exposure, understand composition, evaluate known risks, establish artifact identity, publish useful evidence, and respond as new information appears.

Practice areas

  • Container Assurance Levels — additive Secure, Hardened, and Validated candidate qualification and bounded claim definitions.
  • Vulnerability Management — release assessment, applicability, release gates, monitoring, and remediation objectives.
  • Container and Ubuntu STIG Evidence — common Container Platform SRG mapping plus complete Ubuntu 24.04 V1R6 Chiseled applicability and per-digest evidence.
  • Software Bill of Materials — artifact-specific component inventory and its limitations.
  • VEX — structured communication of vulnerability applicability and status.
  • Provenance — traceability from a released artifact to its authorized build context and inputs.
  • Artifact Signing — identity and integrity verification for immutable artifacts.

Security claims

Security claims on this site are intended to be bounded and verifiable. Terms such as secure or assured do not mean invulnerable. A scan is a point-in-time assessment, an SBOM may have discovery limitations, a signature does not evaluate behavior, and an artifact's controls do not secure the entire deployment environment.

When a claim applies to a released artifact, the evidence should identify its immutable digest.