Securing Diverse Supply Chains Across Interconnected Systems
summary
Shows how Syft, Grype, OWASP Dependency Check are layered into CI to generate SBOMs and run vulnerability scans, and how Zarf packages those SBOMs and images for air‑gapped environments. Demonstrates automatic creation of CycloneDX/SPDX JSON, SBOM delta comparisons to highlight exactly what changed, and concrete limits: C/C++ builds using Conan/cmake often lack vendor CPEs so NVD lookups fail, requiring experimental dependency‑check parsing and manual reconciliation.
AI-written summary · about
chapters (4)
related talks
23mSupply Chain Security using Free and Open Tools
38mSecuring the chains: Building defensive layers for software supply chains
46mSafely through the dependency minefield using OWASP Dependency Track
30mSupply Chain Security for OpenSource Projects
27mSecuring Open Source With SBOM: From Visibility To Trust
54mSupply Chain Sec /w Dependency Track
25mA Primer on Software Bill of Materials for DevSecOps
29mState of the secure software supply chain