The SolarWinds Hack and the Executive Order on Cybersecurity happened
summary
Explains that the SolarWinds backdoor is an example of CI-corrupted builds and argues software supply chain defense focuses on traceability and hardening three hotspots: source repo, CI, and binary registry. Describes SLSA levels 0–4 (document everything → hermetic reproducible builds), the SBoM required by the Executive Order, and a peer-to-peer build/distribution prototype called Persia that uses randomized builders and gateways to Docker Hub/Maven Central. Recommends shifting left into IDE/CLI, scanning dependencies first, and using jfrog CLI (jfrog audit -mvn) plus aggregated vulnerability feeds.
AI-written summary · about
chapters (19)
- 0:00Introduction to supply chain security
- 1:55What is supply chain security
- 2:37Evolution of supply chain attacks
- 5:48Software supply chain security focus
- 6:10Project SLSA overview
- 8:59Common software supply chain attacks
- 11:27Project Pyrsia overview
- 14:58DevSecOps security areas
- 17:25Vulnerability information sources
- 18:27Malicious package infection methods
- 22:17Common malicious package payloads
- 24:02Obfuscation techniques in malware
- 26:31Where to place security in development
- 27:58Dependency management and scanning
- 28:39Shifting left beyond CI environment
- 30:02Using CLI for early security checks
- 32:30Software Bill of Materials (SBOM)
- 34:15Maintaining production with SBOM
- 36:03Summary and additional resources
related talks
54mSupply Chain Security for OpenSource Projects
29mState of the secure software supply chain
12mAs Strong As the Weakest Link: Securing the Software Supply Chain
39mReflections on Trust in the Software Supply Chain
12mKeynote: DevSecOps and the Art of Not Ending Up On the Front Page
15mSoftware Supply Chain Security for those in a rush
29mSupply Chain Security: Threats, Defenses And What You Can Do
57mThe Secure Software Supply Chain