Open Source Software (OSS) Transparency for Acquisition
summary
Argues for treating software supply chain as a first class object in acquisition and offers a reuseable Security Acquisition Framework with 51 goals and 334 practices plus a GQ(I)-driven measurement approach to get supplier transparency and process metrics. Gives concrete anchors: aligns to SSDF, expects vendors to provide a software bill of materials (SBOM) per OMB guidance, surveys tools like TruffleHog and Twistlock in pipelines, and cites 35M LOC (F‑35) → ~1,000 potential vulnerabilities as an example.
AI-written summary · about
chapters (11)
- 0:00Introduction and context
- 1:45Security acquisition framework overview
- 5:57Supply chain risks in software
- 8:47Software vulnerabilities and lifecycle
- 13:41Sources of vulnerabilities
- 16:12Supply chain transparency goals
- 19:23Government policies and frameworks
- 23:58National cyber policy requirements
- 26:23Aligning with secure software development
- 29:57Transparency and buyer awareness
- 31:39Closing remarks and Q&A
related talks
11mSupply Chain Cybersecurity
09mSecuring the Software Supply Chain with Open Source
51mThe Opposite of Transparency
44mNavigating Open Source and Open Standards for Better Cybersecurity
34mSupply Chain Security, SBOMs and How OSPOs Can Play An Important Role Going Forward - An Ecosystem and Compliance Update
40mImproving Supply Chain Integrity with Ope...
11mOSS Supply Chain Security
40mPractical guides for enhacing your Software Supply Chain Security