Application security from start to finish
summary
Describes concrete supply‑chain disasters (the event‑stream / flatmap‑stream compromise that targeted a Bitcoin wallet, an 11‑line package withdrawal that breaks builds, and SolarWinds’ 2020 breach hitting ~33,000 customers) and demonstrates preventive measures: run development in ephemeral, least‑privileged environments (GitHub Codespaces), detect leaked secrets with secret scanning and rotation, keep dependencies current with Dependabot auto PRs, perform SCA plus CodeQL dataflow queries for SAST and add DAST/spidering in CI.
AI-written summary · about
chapters (9)
- 0:00Start
- 1:37The event-stream incident
- 7:35Phishing
- 12:25Namespace shadowing
- 25:35Know your dependencies!
- 29:11Software Bill of Materials (V2 OWASP SCVS)
- 35:53Static Application Security Testing (SAST)
- 38:55Dynamic Application Security Testing (DAST)
- 40:29Infrastructure Scanning
related talks
39mSoftware Supply Chain Security
49mFrom Application Security to Developer Security
15mSoftware Supply Chain Security for those in a rush
54mFrom App Security to Dev Security – Shift left with GitHub Advanced Security
36mBuilding a Trusted and Resilient Software Supply Chain
51mSecurity 101: A Beginner’s Guide to Cybersecurity and Zero Trust for Developers
37mSupply Chain Attacks and the Future of Software Delivery
41mHow to protect your software project from supply chain security threats