Rising Threat: Securing Your Open-Source Pipeline
Talkat Global Security Vulnerability Summit @ Open Source Summit North America 2022 · on Friday, 2022-06-24· at 14:00· Brazos (Level 2), JW Marriott Austin, 110 E 2nd Street Austin, TX 78701·
summary
Walks through a real dependency confusion case where a researcher uploads mimicking packages to a public repo and successfully exfiltrates host and user info, cites 28 million users on conda, and warns a single incident can cost $1.8 million average ransomware cost. Recommends a central, authenticated mirror plus API and audit logs, automated policy enforcement with CVE enrichment that uses curated repository flags (cleared / mitigated / disputed), and CVE refreshes as often as every four hours.
AI-written summary · about
chapters (7)
- 0:00Start
- 0:42Pitfalls
- 2:35Primary Approaches
- 8:50The Dependency Confusion
- 11:48Open Source Maturity Curve
- 13:08Automate Monitoring
- 14:40Pitfalls To Avoid
related talks
29mSecuring the Unseen: Defending Against Open Source Software Supply Chain Attacks
43mHow to hack and defend (your) open source
49mTrustworthy Open Source: The Consequences of Success
42mHacking the OSS Supply Chain
51mOSS Supply Chain Threats and Why You Need a Holistic Security Strategy
32mBreaking the Chain: Advanced Offensive Strategies in Software Supply Chain
13mKeynote: Hacking the OSS Supply Chain
41mHow to protect your software project from supply chain security threats