Building a Trusted and Resilient Software Supply Chain
summary
Concrete takeaways and demos for immediate use not vague promises: real attack cases like SolarWinds log4shell codecov and the recent XZ backdoor frame why supply chains fail; surprising scale metrics — average project has 500+ dependencies and over 90% external code with 4 million weekly downloads of vulnerable log4j versions; concrete mitigations shown include digital signatures and attestations, SBOM generation and tools Sigstore Syft Grype for signing scanning and vulnerability triage.
AI-written summary · about
chapters (9)
- 0:00Introduction
- 1:24Software supply chain
- 7:06Major supply chain attacks
- 16:23Government response & open source
- 19:36Trust in dependencies
- 24:18Choosing dependencies safely
- 29:42Automating dependency management
- 32:31Summary
- 32:53Q&A
related talks
41mHow to protect your software project from supply chain security threats
39mSoftware Supply Chain Security
37mSupply Chain Attacks and the Future of Software Delivery
33mWhat is the secure software supply chain
15mSoftware Supply Chain Security for those in a rush
39mReflections on Trust in the Software Supply Chain
12mKeynote: A Vision for a Secure Software Supply Chain
25mSupply Chain Attacks