Securing the software supply chain
summary
A prototype web platform performs automated SBOM scanning and integrates into CI/CD pipelines, producing a composite risk score across contributor profile, project activity, code quality and a dynamic CV+ metric. It flags four pipeline touchpoints (architecture, build, production updates, end‑of‑life), supports about 12 runtime targets (Docker, Kubernetes, AWS, OpenShift, VMware), uses a 90‑day CV activity window, and delivers golden images plus per‑component and system scores; the EU‑funded service is near production.
AI-written summary · about
chapters (20)
- 0:00intro
- 1:43preamble
- 2:03agenda
- 2:59marek and aleksander
- 3:37risk model
- 5:49fundamentals
- 7:15whys and whats of software composition analysis
- 8:36risks - what if we don't?
- 9:35software composition analysis - risk management (scarm)
- 12:01contributor profile
- 16:29project activity = project dynamics
- 19:56code quality
- 22:27vulnerabilities (cve dynamics)
- 26:37how to plug it into the software deployment pipeline?
- 28:57production pipeline
- 30:09devsecops by linux polska
- 30:48how to make it happen? just start...
- 32:33new web service platform...
- 34:31streamline your security assessments
- 35:45sourcemotion
related talks
27mSecuring the Software Supply Chain: Integrating OpenSSF Scorecard, Jenkins, and the O...
38mSecuring the chains: Building defensive layers for software supply chains
23mSupply Chain Security using Free and Open Tools
27mSecuring Open Source With SBOM: From Visibility To Trust
29mUnlocking the Power of SBOMs: A Deep Dive into Risk Management and Cybersecurity Posture
32mSoftware Supply Chain Security
30mSupply Chain Security for OpenSource Projects
41mSupply Chain Armoring: Tools and Techniques for Open Source Projects