Securing the Unseen: Defending Against Open Source Software Supply Chain Attacks
summary
Open source makes up 80–90% of deployed code so a tiny app can pull in 73,000 lines of third‑party code and 79 transitive deps on average. Examples include dependency confusion and typo‑squatting, the Codecov bash script that exfiltrated CI secrets, SolarWinds’ build compromise, event‑stream’s wallet siphon, and Kubeflow jobs used for crypto mining. Recommended controls: SCA in IDE/CICD, scan container base images, push protection for secrets, and produce/ingest a software bill of materials (SBOM).
AI-written summary · about
chapters (7)
- 0:00Supply chain security threats
- 1:50Open source dependency risks
- 8:18Supply chain attack vectors
- 14:44Why attacks are hard to detect
- 20:50Long-term risk mitigation
- 22:35Defense tools and practices
- 24:42Q&A on zero-day and contributors
related talks
39mOpen Source Software Supply Chain Security — Why does it matter?
41mManaging the Risk of Software Supply Chain Attacks
09mSecuring the Software Supply Chain with Open Source
54mSupply Chain Security for OpenSource Projects
41mHow to protect your software project from supply chain security threats
07mHow to Secure Your End-to-end Supply Chain
51mOSS Supply Chain Threats and Why You Need a Holistic Security Strategy
37mSupply Chain Attacks and the Future of Software Delivery