In order to meet the project delivery deadline, a web application developer used readily available software components. Which is the BEST method for reducing the risk associated with this practice?

Using approved software development frameworks is a general good practice but does not directly address the supply chain risk associated with the provenance of readily available components themselves.

Obtaining software components from official sources over a secured link directly mitigates the risk of introducing malicious code, backdoors, or unpatched vulnerabilities from unofficial or tampered sources. This practice ensures the integrity and authenticity of third-party components by verifying their origin and protecting them during transit.

Encrypting sensitive data protects the data at rest and in transit but does not reduce the inherent risks of vulnerabilities or malicious code within the software components processing that data.

Implementing a process to verify effectiveness is a good post-acquisition step, but it is less proactive than preventing compromised components from entering the supply chain in the first place.