What Data Tells Us About Software Supply Chain Security & What To Do About It
summary
Research scans 3 million Dockerfiles to find popular base images, revealing a Node base with 800 vulnerabilities and some CVEs dating to 2003–2004; only about 5% of ecosystems use package signing. A community-led Global Security Database (GSD) aims to expand vulnerability coverage and speed IDs, while efforts like s-bombs (SBOMs), the Wolfi zero‑CVEs base images, VEX for exploit applicability and EPSS for exploit prediction are under development; many tools exist but adoption, attestation quality and automated consumption remain the real gaps.
AI-written summary · about
chapters (8)
- 0:00Introduction
- 2:53Data sources for supply chain
- 8:49Internal dependency data
- 13:44Defining supply chain security
- 17:34Prioritizing dependencies
- 19:43Using SBOMs effectively
- 23:35Assessing container vulnerabilities
- 28:33Closing remarks
related talks
40mPanel Discussion: Open Source Supply Chain Security - Are Containers..
29mDay in the Life of a Base Image: The Evolution of Vulnerabilities in the Most Popular C...
38mSecuring the chains: Building defensive layers for software supply chains
29mFragile by Design: Large-Scale Evidence of Supply Chain Risk
37mThe State of Open Source Security
35mSecuring Containers by Breaking In
16mUnpacking Open Source Security in Public Repos
24mHow to Find Secure Software in Open Source Repositories