The Iceberg: Your Attack Surface Just Got Bigger
summary
Claim: application code comprises 10–20% application code of the total codebase while 80–90% is open source dependencies, containers and IaC, dramatically expanding attack surface. Example threats include a malicious "Fall Guys" package that reads local files and exfiltrates via Discord and the 2021 Log4Shell supply chain impact. Practical build: a three-step pipeline: SCA, secret scanning, static analysis using Renovate/Snyk, GitGuardian and CodeQL as GitHub Actions triggered on PRs, reporting to PR checks and Slack, which successfully surfaces vulnerabilities and leaked secrets.
AI-written summary · about
chapters (10)
- 0:00Introduction to open source risks
- 2:54Understanding the iceberg model
- 5:25Securing the modern codebase layers
- 7:10Building a secure CI/CD pipeline
- 11:21Static code analysis tools
- 14:29Pull request security workflow
- 15:33ChatOps for security visibility
- 16:56Documentation and tracking
- 18:00Best practices and guardrails
- 21:28Key takeaways and conclusion
related talks
29mSecuring the Unseen: Defending Against Open Source Software Supply Chain Attacks
45mBuilding Secure Software: Practical Strategies for Developers
01h 32mYour Applications are Under Attack: Protecting each step of the development lifecycle
53mFlipping the Script on Application Security
45mPanel Discussion: Managing Open Source...
13mKeynote: Hacking the OSS Supply Chain
26mStranger Danger: Your Attack Surface Just Got Bigger
26mSmarter Code, Sneakier Risks: Supply Chain Security in the Age of AI