DOES14 - Joshua Corman - Sonatype
summary
Argues software behaves like a software supply chain, not bespoke craft, citing Maven Central serving ~13 billion requests and IoT driving that toward ~25 billion; modern cars have ~69 microprocessors and more code than Windows XP. Shows Heartbleed infects industrial controllers and 600,000 exposed devices drop to ~300,000 patched, and reports a disturbing audit: only 41% fixed of disclosed flaws with a mean time to remediate of 390 days MTTR; proposes a Cavalry initiative, Rugged Manifesto, an automotive cyber safety framework, and federal procurement rules requiring a bill of materials, no known-vulnerable components, and updatability.
AI-written summary · about
chapters (6)
- 0:00Start
- 14:05A TALE OF TWO QUAKES
- 16:27LEAST SPENDING/PRIORITY: WEAK SOFTWARE
- 17:06LEAST SPENDING/PRIORITY: WEAK SW
- 18:17MOST IMPACT: BUY/BUILD DEFENSIBLE SOFTWARE
- 27:25Compound Project
related talks
41mThe Divine and Felonious Nature of Cyber Security
39mWhat is Rugged all About?
47mContinuous Acceleration: Why Continuous Everything Requires A Suppl...
18mSecuring Open Source in Nomura’s Software Supply Chain
41mSponsored Session: Software Supply Chain Threat Landscapes: A Moving Target
35mMachines Making Software
32mAdapting DevOps in a World of Growing Software Supply Chain Attacks
31mOpen Source Supply Chain Threat Landscape - A Moving Target