How to protect your software project from supply chain security threats
summary
Covers concrete incidents and concrete defenses: SolarWinds is a complex targeted implant, Log4Shell is a real remote code execution vector, typo‑squatting hits libraries with 1.3 million weekly downloads, dependency‑confusion and PyTorch-style pull‑in flaws happen, the XZ utils backdoor takes two years to plant backdoor, an LLM‑hallucinated package hits 30,000 downloads of fake package, and open source decays 20% decay per year; mitigations: SBOMs, provenance and reproducible builds, immutable builds, stop‑the‑build on test failures, signed images and platform teams enforcing policies.
AI-written summary · about
chapters (12)
- 0:00Software supply chain security intro
- 1:47Why security matters now
- 3:56Real-world attack examples
- 15:52AI-driven supply chain risks
- 18:43Open-source maintainer problems
- 23:21Source code security solutions
- 30:24AI code assistants risks
- 32:08Securing the build phase
- 35:15Deploying with policies
- 36:58Updating secure software
- 37:19Corporate security program
- 39:30Key takeaways
related talks
36mBuilding a Trusted and Resilient Software Supply Chain
58mAttacking through the Software Supply Chain
37mSupply Chain Attacks and the Future of Software Delivery
54mSupply Chain Security for OpenSource Projects
29mSecuring the Unseen: Defending Against Open Source Software Supply Chain Attacks
57mThe Rise of Software Supply-Chain Attacks – How Secure is your .NET Application?
39mSoftware Supply Chain Security
46mThe Rise of Malware Within the Software Supply Chain