Let's Play AI Supply Chain Candyland!
summary
A board-game style framework called AI Supply Chain Candyland is built to map end-to-end AI/ML development, highlighting that data and models must join code in dependency inventories, that MLOps/DataOps/DevOps converge, and that threat modeling, prompt engineering, and drift detection are essential. An AI model-signing project integrated with sigstore is released for model provenance; projects mentioned include Salsa, GUAC and SBOMs, Scorecard, Dependabot. A Dell/Ericsson reference architecture white paper is pending publication.
AI-written summary · about
chapters (20)
- 0:00AI Supply Chain Candyland
- 1:02AI supply chain security matters
- 3:56AI Supply Chain Candyland game
- 7:50Confectionary Planning Orchard
- 9:57Peppermint Forest dependencies
- 13:29Data Overlord challenges
- 15:56Magical Model Mountains
- 17:43Model validation
- 18:45Lead Programmer's Lodge
- 20:49Quality Assurance Woods
- 22:14Lollipop Code Maven
- 23:18Frozen Dessert Deployment
- 24:01Fudgy Swamp compliance
- 26:30Sweet Success Citadel
- 27:14Reflecting personas next steps
- 31:30OpenSSF secure AI resources
- 33:15Q&A Community Day
- 35:07Q&A OpenSSF AI personas
- 38:37Q&A OpenSSF AI tools
- 42:10Q&A Agents AI landscape
related talks
25mAI-Driven Supply Chain Security: Using AI-BOM to Detect Hidden Vulnerabilities
12mDevSecOps Playbook for AI-Era CI/CD Pipelines
16mNavigating the AI Jungle
45mSecuring Software Supply Chain: Problems, Solutions, and AI/ML Challenges
33mAI in the Security Stack
17mLightning Talk: Navigating the Intersection: AI’s Role in Shaping the Secure Open Sour...
19mModel transparency for AI/ML security
32mAI Software Bill of Materials: From the EU AI Act to Your MLOps