Why You Should Care About Open Source Supply Chain Security
summary
Explains how software supply chain attacks work, why open source projects are particularly at risk, and common points attackers exploit. Covers supply chain security concepts and terminology, and describes open source projects and frameworks you can use to protect your software and evaluate the security practices of your dependencies.
AI-written summary · about
chapters (21)
- 0:00Intro
- 1:01OPEN SOURCE SUPPLY CHAIN SECURITY (AND WHY YOU SHOULD CARE)
- 1:38OVERVIEW
- 3:43AFFECTING OPEN SOURCE ECOSYSTEMS
- 5:25UNAUTHORIZED CHANGES
- 7:19COMPROMISED SOURCE REPO
- 8:14BUILD FROM MODIFIED SOURCE
- 9:27COMPROMISED BUILD PROCESS
- 11:18USE COMPROMISED DEPENDENCY
- 13:15UPLOAD MODIFIED PACKAGE
- 13:49COMPROMISE PACKAGE REPO
- 14:11USE COMPROMISED PACKAGE
- 15:58WHAT QUESTIONS MIGHT WE WANT TO ANSWER?
- 18:00TERMINOLOGY
- 21:07SIGSTORE
- 22:31SLSA EXPLAINED
- 24:09SLSA 1.0
- 26:10EVALUATING RISKS
- 26:50TRANSITIVE DEPENDENCIES
- 30:09WHAT'S THE LATEST AND GREATEST?
- 30:56SUPPORT OPEN SOURCE
related talks
39mOpen Source Software Supply Chain Security — Why does it matter?
09mSecuring the Software Supply Chain with Open Source
07mHow to Secure Your End-to-end Supply Chain
52mOpenSource as an attack vector: how dangerous is it and how to fix it?
11mSupply Chain Cybersecurity
41mManaging the Risk of Software Supply Chain Attacks
29mSecuring the Unseen: Defending Against Open Source Software Supply Chain Attacks
29mSupply Chain Security in the Software Era