Open Source Software Supply Chain Security — Why does it matter?
summary
Open source components appear in most products and attackers shift to the supply chain because a single compromise scales: SolarWinds' build system breach signs malicious binaries and stays undetected for six months, and dependency confusion researchers push code into Apple/Microsoft/Google. Recommended defenses include SLSA provenance attestations, generating SBOM (CycloneDX, SPDX) for releases, signing with sigstore/reproducible builds, running scorecards/Allstar, and using org-wide tooling (Eclipse’s Jenkins provenance generator and a “hotdog” repo-policy manager) plus enforced 2FA.
AI-written summary · about
chapters (13)
- 0:00Open source supply chain security
- 1:09Cybercrime's economic impact
- 3:16SolarWinds Orion attack
- 6:29Developer vs repository threats
- 9:20Malicious package hijacking
- 12:12Supply chain vulnerabilities
- 15:25Repo jacking risks
- 18:40Dependency and typo squatting
- 21:30Registry compromises
- 24:43Mitigation strategies
- 27:31SLSA framework
- 29:38Measuring security with Scorecard
- 34:17Key takeaways
related talks
09mSecuring the Software Supply Chain with Open Source
29mSecuring the Unseen: Defending Against Open Source Software Supply Chain Attacks
15mSoftware Supply Chain Security for those in a rush
30mSecuring Open Source Supply Chains
41mManaging the Risk of Software Supply Chain Attacks
11mSupply Chain Cybersecurity
43mOur Dependence on Open Source Is Scary. SLSA, SBOM and Sigstore to the Rescue
54mSupply Chain Security for OpenSource Projects