Supply chain security for dummies
summary
Explains concrete risks and fixes: real-world incidents such as KOA npm package (new malicious versions after 3 years, >1M weekly downloads), the Codecov compromise (malicious uploader exfiltrating env vars, ~25,000 orgs affected), and a GitLab breach exposing ~500 repos; cites a 700% rise in supply‑chain attacks (2019–2022). Recommends specific actions: private package mirrors and offline builds, harden CI/CD servers, enforce granular access, scan and sign images, adopt SBOMs and SLSA levels to verify provenance.
AI-written summary · about
chapters (5)
- 0:00Supply chain security intro
- 3:29Code-level security
- 7:02Build-level risks & fixes
- 10:56Deployment challenges
- 13:22Industry efforts & outlook
related talks
38mSupply Chain Security & the Real World: Lessons From Incidents
39mSoftware Supply Chain Security
37mSupply Chain Attacks and the Future of Software Delivery
15mSoftware Supply Chain Security for those in a rush
35mSupply Chain Attacks: The New Reality
29mSupply Chain Security: Threats, Defenses And What You Can Do
41mManaging the Risk of Software Supply Chain Attacks
07mHow to Secure Your End-to-end Supply Chain