Running in the Shadow: Perspectives on Securing the Software Supply Chain
summary
Panelists compare concrete fixes: federal policy uses NIST-based self‑attestation deadline for vendors, FedRAMP updates, and guidance aiming to shift liability and buying power; industry shows tools like SBOMs, build-time provenance and automated CVE matching; open source risks surface in Log4j and SolarWinds incidents and a Harris Poll finds 77% vs 68% tension between security leads and developers with 2 in 5 devs resisting added friction; the government pushes memory safety (claimed ~70% vulnerability cut) and asks for implementable pilots.
AI-written summary · about
chapters (10)
- 0:00Introduction and welcome
- 1:31Panelist introductions
- 6:54US policy efforts overview
- 11:30National Cybersecurity Strategy
- 17:24Implementing government guidance
- 21:41Security vs developer tensions
- 28:46Open source challenges
- 33:26EU supply chain lessons
- 35:18Stronger Together wishes
- 40:24Audience Q&A
related talks
44mPanel Discussion: Improving the Software Supply Chain Security
27mSecurity: The Thing That Everyone...
50mSoftware Supply Chain: Panel on Threat Intel, Trends, Mitigation Strategies
54mSecuring the Digital Supply Chain: What we should do for Supply Chain Security in DevSecOps?
39mSoftware Supply Chain Security
12mKeynote: DevSecOps and the Art of Not Ending Up On the Front Page
06mSponsored Keynote: Trust and Risk in the Software Supply Chain
36mBuilding a Trusted and Resilient Software Supply Chain