Supply Chain Attacks
summary
Explains that modern supply chain attacks rely on trusted third‑party components and cites real incidents like Log4j, SolarWinds plus CNCF-listed compromises (ProFTPD, WordPress, CodeSpaces, Juniper, Homebrew, VS Code). Recommends running software composition analysis (SCA) against dependencies, adding static and dynamic analysis, enforcing MFA, encryption, alerting and patch windows, and treating remediation as a prioritized workflow. Emphasizes open‑source SCA tools are viable and that no single control is sufficient.
AI-written summary · about
chapters (14)
- 0:00Introduction
- 1:35Supply chain attacks matter
- 2:58Open source in software
- 4:01Tracking vulnerabilities
- 7:34Software composition analysis
- 9:43Understanding supply chain attacks
- 11:11Zero trust principles
- 13:17Notable attack examples
- 15:01MITRE framework for security
- 16:47Malicious code in pipeline
- 18:11Hardware risks in supply chain
- 19:36Preventing supply chain attacks
- 23:26Security is layered
- 24:53Closing remarks and Q&A
related talks
37mSupply Chain Attacks and the Future of Software Delivery
39mSoftware Supply Chain Security
41mManaging the Risk of Software Supply Chain Attacks
35mSupply Chain Attacks: The New Reality
15mSoftware Supply Chain Security for those in a rush
29mSupply Chain Security: Threats, Defenses And What You Can Do
14mSupply Chain Security, why should I care?
36mBuilding a Trusted and Resilient Software Supply Chain