Supply Chain Attacks and the Future of Software Delivery
summary
Describes how supply-chain attacks are a growing portion of incidents (about 20%), with examples like SolarWinds (build-system compromise and signed malicious builds impacting ~18,000 networks) and Codecov (Bash uploader creating reverse shells into CI). Recommends concrete defenses: SBOMs, binary authorization and artifact signing, Salsa maturity levels, OSV/vulnerability databases, deps.dev/scorecard, a malicious-packages feed, and maintainer funding programs, and presents demos and incident analyses showing which tools and practices actually reduce risk.
AI-written summary · about
chapters (7)
- 0:00Supply chain attacks intro
- 3:56History of supply chain attacks
- 14:39Modern software risks
- 17:08Injecting malicious code
- 25:13Mitigating supply chain risks
- 27:41Security tools and initiatives
- 35:40Summary
related talks
35mSupply Chain Attacks: The New Reality
39mSoftware Supply Chain Security
29mSupply Chain Security: Threats, Defenses And What You Can Do
25mSupply Chain Attacks
38mSupply Chain Security & the Real World: Lessons From Incidents
41mManaging the Risk of Software Supply Chain Attacks
15mSupply chain security for dummies
15mSoftware Supply Chain Security for those in a rush