Securing the chains: Building defensive layers for software supply chains
summary
Builds an open source pipeline called Supply Shield that scans Docker images (SIFT, ScanCode) to generate SBOMs and capture exact runtime versions, then uses layer-hash segregation to attribute base‑image vulnerabilities and detect unapproved or outdated base images. Adds source‑level SBOMs via CDX gen to recover transitive dependency relationships, implements an algorithm to assign ownership for common packages, and prioritizes fixes by public‑facing/ reachable services while surfacing concrete upgrade actions.
AI-written summary · about
chapters (24)
- 0:00Introduction and concepts
- 3:07Defining the problem
- 4:03Strategic planning
- 4:27Implementation strategy
- 6:14Scanning architecture
- 7:11Addressing ownership issues
- 7:26Layer-based accountability
- 7:49Filtering base image issues
- 8:43Identifying alien images
- 9:29Handling blocking challenges
- 10:12Detecting outdated images
- 12:29Application-level patching
- 13:13Pushback and challenges
- 13:35Transitive visibility
- 14:30SBOM relationship gaps
- 15:12Combined scanning approach
- 16:01Pipeline integration
- 17:09Tooling contributions
- 18:30Managing common packages
- 19:55Graph-based segregation
- 22:31Prioritization logic
- 22:53Actionable dashboards
- 23:12Future features and takeaways
- 24:53Q&A session
related talks
23mSupply Chain Security using Free and Open Tools
41mSupply Chain Armoring: Tools and Techniques for Open Source Projects
33mWhat is the secure software supply chain
28mBuilding Images for the Secure Supply Chain
32mSoftware Supply Chain Security
39mSecure Your Supply Chain: Adding a Software Bill of Materials to Your Containers to Improve...
30mSupply Chain Security for OpenSource Projects
22mSofware Supply Chain Security Is Hard. But Does it Need to Be?