.NET supply chain: Protecting against hidden threats
summary
Demos show concrete fixes: running net list package --include-transitive exposes hidden transitive deps, nuget audit now warns (and .NET 10 defaults to scanning all deps) and treating those warnings as errors breaks builds until updated; using package log.json plus content hashes makes restores reproducible and reproducible-build checks fail if a build agent injects a different package. Trivy finds licenses (demo returned BSD-3 and MIT), supply chain reliance hits ~80% external code and tiny libs can have 400k or 92M weekly downloads.
AI-written summary · about
chapters (10)
- 0:00Introduction to supply chain
- 2:21Historical context and threats
- 5:03Cyber Resilience Act overview
- 7:50Managing .NET dependencies
- 11:43NuGet auditing and configuration
- 17:34License management and tools
- 22:06Supply chain risk management
- 24:31Attack vectors and mitigation
- 34:37Reproducible build environments
- 40:47Transparency and conclusion
related talks
57m.NET supply chain: Protecting against hidden threats
56m.NET supply chain: Protecting against hidden threats
27m.NET Supply Chain Beneath the Surface
57mThe Rise of Software Supply-Chain Attacks – How Secure is your .NET Application?
58mThe Rise of Software Supply-Chain Attacks – How Secure is your .NET Application?
52mBuilding Community-Driven Security Analysis for Your .NET Software Supply Chain
48mYour .NET App Is Probably Vulnerable Right Now
58mSecuring your .NET application software supply chain