FOSS and Security Risk Management
summary
Examines how EU laws (AI Act, CRA, eID) change software liability and shifts to concrete supply‑chain controls: ongoing coordinated pollution attacks since March leave 100,000 unremediated packages, pipeline trust breaks when repos or build systems are owned, and unpinned dependencies widen attack windows. Demonstrates tooling and practices that are already usable: OpenSSF scorecard monitor measuring five risk categories, SLSA/Salsa provenance levels, and graph tools like guac to trace vulnerable dependency paths.
AI-written summary · about
chapters (10)
- 0:00Introduction and speaker background
- 1:25EU software regulation overview
- 4:22Open source supply chain threats
- 7:18Manual risk assessment in projects
- 8:23OpenSSF Scorecard explained
- 13:35Scorecard metrics deep dive
- 18:59Using Scorecard for compliance
- 21:56Other security tools and resources
- 24:26Upcoming OpenSSF events
- 25:33Q&A and closing remarks
related talks
21mNavigating the Intersection: AI’s Role in Shaping the Secure Open Source Software Ecos...
13mSecuring the Software Commons: Standards, Automation, and AI for a Resilie...
41mManaging the Risk of Software Supply Chain Attacks
25mYour Software Supply Chain is Only as Secure as its Weakest Link- 25mYour Software Supply Chain is Only as Secure as its Weakest Link
59mMerging Security and Compliance: Perspectives on Emerging Regulations and Best Practices
27mBeyond Open Source Risks With the CRA and NIS2
54mSpeaking Up For FOSS Now Everyone Uses It