What is the secure software supply chain
summary
Defines the concrete attack surface: average project pulls 500 dependencies and over 90% of code is external, with Composer hosting ~300K packages and 2 billion downloads; demonstrates exploit classes against Terraform and an XZ supply‑chain backdoor that took three years to seed. Shows signing and provenance using Sigstore and SBOM generation with Syft, and builds signed OCI images deployed to Kubernetes with Kyverno policies and SBOM‑based scanning so the demo actually produces and enforces secure images.
AI-written summary · about
chapters (13)
- 0:00Introduction
- 1:28Software supply chain
- 2:30Open source threats
- 7:07SolarWinds attack
- 8:34XZ backdoor deep dive
- 13:58Cybersecurity laws
- 15:04PHP Composer security
- 17:37Trusting dependencies
- 21:50Choosing dependencies safely
- 23:37Evaluating project quality
- 25:20Automating dependency management
- 26:44Live demo
- 27:28Q&A
related talks
36mBuilding a Trusted and Resilient Software Supply Chain
29mState of the secure software supply chain
12mKeynote: A Vision for a Secure Software Supply Chain
37mSupply Chain Attacks and the Future of Software Delivery
40mPractical guides for enhacing your Software Supply Chain Security
38mSecuring the chains: Building defensive layers for software supply chains
29mSecuring the Unseen: Defending Against Open Source Software Supply Chain Attacks
15mSoftware Supply Chain Security for those in a rush