Three Things That Each Developer Should Know to Help Secure Code Base
summary
Claims that supply‑chain attacks will hit about half of companies by 2027 and that Sonatype sees ~250,000 supply‑gen incidents this year, with widely used libraries (Log4Shell among them) still present in millions of downloads. Recommends generating SBOMs with tools like Syft and scanning with Grype or Bomber, validating builds via Reproducible Builds and signing with SigStore, and using Sonatype BOM Doctor to triage high‑severity findings and automate patches.
AI-written summary · about
chapters (24)
- 0:00Introduction
- 1:49Cybercrime impact
- 3:57Cyber warfare threats
- 6:53AI attack surfaces
- 8:40Known vulnerabilities shift
- 10:03Closing exploit windows
- 11:08Nation states exploits
- 12:34Supply chain risks
- 13:18Licensing challenges
- 14:22Government open source efforts
- 15:26SBOM explained
- 17:12Vulnerability scanning tools
- 19:25Patch management policies
- 20:27Kubernetes SBOM scoring
- 21:08Reproducible builds
- 22:32Code signing pipelines
- 23:39Log4j vulnerability impact
- 25:53Vulnerable downloads stats
- 26:54Convincing managers
- 28:21Open source security evaluation
- 30:24Dependency security best practices
- 31:47Security culture productivity
- 32:09Three key actions
- 32:29Java Advent Calendar
related talks
41mManaging the Risk of Software Supply Chain Attacks
36mPanel: It’s Not If, It’s When - Practical Preparation for the Next Software Supply Chain Attack
37mSupply Chain Attacks and the Future of Software Delivery
31mOpen Source Supply Chain Threat Landscape - A Moving Target
32mAdapting DevOps in a World of Growing Software Supply Chain Attacks
49mMitigate Risks In Code: Protect Your Software based Supply Chain
56mA New Hope for 2023? What Developers Must Learn Next
41mSponsored Session: Software Supply Chain Threat Landscapes: A Moving Target