Software Supply Chain Security
summary
Covers concrete failures and fixes: the Event‑Stream backdoor (malicious code inserted into a 2011 package), a 2015 Java markdown flaw taking over a year to patch, SolarWinds and the December Apache logging (Log4Shell) fallout, and Visual Studio Code account exposure. Recommends tracking dependencies with an SBOM and CycloneDX, hardening CI/CD, containers and secret management, doing threat modeling, and appointing security champions. Cites Gartner’s projection of 45% by 2025 for organizations hit by supply‑chain attacks.
AI-written summary · about
chapters (10)
- 0:00Introduction and welcome
- 1:32Speaker background
- 4:11The software supply chain
- 7:01Open source security
- 10:38Evolution of development
- 14:17Real-world attack examples
- 17:41Risk mitigation strategies
- 21:47Managing dependency risks
- 26:13Community and best practices
- 31:21Q&A session
related talks
37mSupply Chain Attacks and the Future of Software Delivery
15mSoftware Supply Chain Security for those in a rush
15mSupply chain security for dummies
25mSupply Chain Attacks
38mSupply Chain Security & the Real World: Lessons From Incidents
36mBuilding a Trusted and Resilient Software Supply Chain
19mKeynote: Supply Chain Security in 2024
29mSupply Chain Security: Threats, Defenses And What You Can Do