ISC2 Certified Secure Software Lifecycle Professional (CSSLP) Practice Question

HTTPS already provides confidentiality and integrity while the files are in transit, and authenticated access to the portal establishes who initiated the download. Once the binaries leave the portal, however, customers have no cryptographic proof that they remain unaltered or truly originated from the publisher. That open issue concerns the principle of integrity (with authenticity and non-repudiation as collateral benefits). Applying a digital code-signing certificate to each release embeds a signature created with the publisher's private key. Customers can later validate the signature with the corresponding public key-even on an offline or air-gapped network-to confirm the software has not been modified. Strengthening portal authentication, storing the files encrypted, or adding redundancy helps other principles (confidentiality, availability) but does not allow customers to detect post-download tampering.