Software Supply Chain Aspects in Infrastructure as Code
summary
KICS is an open source ruleset for scanning Dockerfiles, Helm charts and other IaC formats while tracing real supply chain problems such as typosquatting and malicious clones that led to campaigns publishing more than a thousand malicious PyPI and npm packages. Container registries return confusing results — the official MinIO image shows 500 million downloads and 600 stars while lookalikes show 10 million downloads — and scanners miss binaries that lack package metadata. Recommendations are KICS, prefer git sources, verify checksums, use reproducible builds and consider signatures like Cosign but not as sole proof.
AI-written summary · about
chapters (21)
- 0:00Intro
- 0:43Infrastructure as Code
- 0:55Software Supply Chain
- 2:00Software Security
- 7:36(some) laC Efficiency
- 10:06Find a HELM chart
- 11:55Levels of Typosquatting
- 12:34Supply Chain Security & laC
- 16:17Container Supply Chain
- 17:35debian:buster-slim
- 20:50You're wrong, because...
- 21:50The importance of metadata
- 24:06Verifiable metadata
- 24:27Distroless containers
- 26:00Reproducible Builds
- 27:55Reproducibility
- 29:01Signatures (e.g. cosign)
- 30:09These would also be signed..
- 31:37What is the solution?
- 33:07Securing Container Creation
- 35:43Already adopted by GitLab
related talks
40mSoftware Supply Chain Aspects in Infrastructure as Code, and How to Secure it
11mAWS On Air ft. Checkmarx
06mRethinking the Software Supply Chain: Trust, Minimalism, and Resili...
21mSecuring the IaC Supply Chain
05mAvoiding IaC misconfiguration (on multiple platforms)
38mSecuring the chains: Building defensive layers for software supply chains
28mBuilding Images for the Secure Supply Chain
32mSoftware Supply Chain Security