3 steps to a secure software supply chain