Sponsored Keynote: Trust and Risk in the Software Supply Chain
summary
Cites a 742% increase in annual supply chain attacks and that six of seven project vulnerabilities come from transitive dependencies, argues automation and continuous controls are essential, and names concrete tools like Sigstore, Cosign, Tekton and SLSA as part of the stack. Describes a production lesson: bolt-on mandates fail, security gates must be negotiated with product timelines and engineering workflows and enforced by automation. Proposes starting by building partnership with engineering and open source so controls become part of development not afterthought.
AI-written summary · about
related talks
12mKeynote: A Vision for a Secure Software Supply Chain
36mBuilding a Trusted and Resilient Software Supply Chain
25mYour Software Supply Chain is Only as Secure as its Weakest Link
22mSofware Supply Chain Security Is Hard. But Does it Need to Be?- 25mYour Software Supply Chain is Only as Secure as its Weakest Link
37mSupply Chain Attacks and the Future of Software Delivery
39mSoftware Supply Chain Security
19mKeynote: Supply Chain Security in 2024