Supply chain security - develop quickly without inviting The Nefarious
summary
Supply chain attacks are rising exponentially per Sonatype and one experiment shows an exposed EC2 instance gets compromised in 2.5–3 hours to be exploited. Practical fixes: lock down cloud IAM, networks, storage and logging; patch and scan worker nodes and container images; enable API server auth, encryption and audit logs; enforce resource limits, least privileges and network policies for workloads; automate continuous security checks in CI/CD and require MFA and signed commits. Notably more than half take a week to never to remediate and managed Kubernetes is not secure by default.
AI-written summary · about
chapters (13)
- 0:00Supply chain security intro
- 1:26Why supply chain security matters
- 4:19Nefarious actors and methods
- 7:26Kubernetes security risks
- 9:10Securing multi-layer Kubernetes
- 11:59DevOps lifecycle security gaps
- 13:26Securing GitHub workflows
- 15:52Supply chain attack trends
- 18:25Actionable improvements
- 19:06DevSecOps shifting left
- 21:11Shared security responsibility
- 22:35Never trust anything or anyone blindly
- 23:37Q&A
related talks
15mSoftware Supply Chain Security for those in a rush
15mSupply chain security for dummies
25mSupply Chain Attacks
14mSupply Chain Security, why should I care?
35mSupply Chain Attacks: The New Reality
41mManaging the Risk of Software Supply Chain Attacks
50mInsights into New Supply Chain and Cloud-Identity Attacks
39mSoftware Supply Chain Security