Panel: It’s Not If, It’s When - Practical Preparation for the Next Software Supply Chain Attack
summary
Practical, tactical steps: generate high-quality SBOMs with tools like SIFT SBOMs, favour providers that can build packages from source so patches ship immediately, and run a 1-hour game day tabletop to rehearse supply-chain response. Metrics matter: Sonatype’s mean-time-to-update predicts remediation speed, Trivy and recent incidents show vulnerability reports spiking (more reports in two months than in five years), and agentic AI both accelerates attacks and helps triage CI/CD issues.
AI-written summary · about
chapters (15)
- 0:00Supply chain threat reality
- 2:33Expert panelists
- 3:16Supply chain attack strategies
- 6:04Software composition and SBOMs
- 9:51Tools for attack response
- 11:39Minimal images and CVE remediation
- 14:26Daily zero-day preparation
- 17:13Security mindset shift
- 21:05Tabletop exercises
- 23:14Security for developers
- 26:03Open source maintainer guidance
- 28:50Maintainer boundaries
- 30:16AI tools for security
- 33:48Fundamentals for agentic threats
- 35:15Closing and next steps
related talks
37mSupply Chain Attacks and the Future of Software Delivery
33mThree Things That Each Developer Should Know to Help Secure Code Base
34mPanel: Platform Engineering to the Rescue - A Practica...
25mYour Software Supply Chain is Only as Secure as its Weakest Link
50mSoftware Supply Chain: Panel on Threat Intel, Trends, Mitigation Strategies
39mSoftware Supply Chain Security
15mSoftware Supply Chain Security for those in a rush- 25mYour Software Supply Chain is Only as Secure as its Weakest Link