Production, Consumption, and the Data: The Open Source Security Sandwich
summary
Argues that security requires stitching production metadata to consumption controls and demonstrates an implemented pipeline: ingest SBOMs, OpenSSF Scorecard, SLSA attestations, VEX/OSV feeds into GUAC to build a queryable graph. Claims few projects actually store and analyze SBOMs today and shows GUAC returning concrete results (Prometheus Go client dependency graph, Kubernetes digest lookup) to prove compliance, prioritize patches, and detect upstream risks; recommends using sigstore and S2C2F for signing and consumption policy.
AI-written summary · about
chapters (17)
- 0:00Software supply chain security intro
- 1:31Why supply chains are on fire
- 3:39Defining supply chain security
- 5:07SDLC attack vectors
- 8:39Securing deep dependencies
- 10:02Open source security progress
- 10:47Getting started with security
- 12:54Balancing security and velocity
- 13:59Tracking software production
- 15:47Open tools for metadata
- 17:12Role and limits of SBOMs
- 18:58Open source security sandwich
- 20:43Trust in open source
- 22:05Aggregating supply chain data
- 22:48Guac supply chain insights
- 25:18Future of SDLC control planes
- 26:10Q&A
related talks
11mOSS Supply Chain Security
44mNavigating Open Source and Open Standards for Better Cybersecurity
44mImproving the Software Supply Chain Security
11mLightning Talk: A Supply Chain Security View of OpenSearch
41mBack to Security Basics: Evaluating, Consuming, and Contributing Open Source...
40mImproving Supply Chain Integrity with Ope...
32mSoftware Supply Chain Security- 44mPanel Discussion: Improving the Software Supply Chain Security