Supply Chain Security, why should I care?
summary
Supply chain attacks rise ~700% recently and six of seven project vulnerabilities come from dependencies, with 13% of downloads still on the log4j vulnerable version; remedy focuses on concrete steps: run dependency analytics in the IDE, produce an SBoM and sign commits and images with Sig store / cosign, verify provenance in the pipeline, enforce policy with conftest / Open Policy Agent, store images in Quay for continuous scanning, and monitor runtime with StackRox or similar.
AI-written summary · about
chapters (8)
- 0:00Supply chain security intro
- 1:15Rising threat of attacks
- 2:19Supply chain challenges
- 3:43Three pillars of security
- 4:49Dev to deployment workflow
- 6:16Secure build pipeline
- 8:55Live security demo
- 12:56Tools and resources
related talks
39mSoftware Supply Chain Security
22mSofware Supply Chain Security Is Hard. But Does it Need to Be?
15mSoftware Supply Chain Security for those in a rush
25mSupply Chain Attacks
41mManaging the Risk of Software Supply Chain Attacks
15mSupply chain security for dummies
37mSupply Chain Attacks and the Future of Software Delivery
36mBuilding a Trusted and Resilient Software Supply Chain