Securing the Digital Supply Chain: What we should do for Supply Chain Security in DevSecOps?
summary
Panel lists concrete attack examples (polyfill typosquatting, Log4j, CrowdStrike outage) and practical fixes: use SCA that reports reachable vulnerabilities (50% flagged, 2 actually reachable), run scanners in the developer sandbox, require threat modeling and secure‑coding in contracts, add autofix pull requests and security wrappers or WAF rules as stopgaps, sign binaries and test DR with Azure virtual desktops for remote recovery, train developers, run security champion programs, and prepare for incoming regulation (Bill C‑26 / litigation).
AI-written summary · about
chapters (12)
- 0:00Introduction and panel setup
- 2:50Recent supply chain attacks
- 7:07Shift left approach effectiveness
- 11:21Challenges in third-party components
- 17:59Integrating security into CI/CD
- 24:37Government concerns on software supply chain
- 29:55Emerging trends in supply chain security
- 37:20Contract requirements for security
- 40:28Context and data sensitivity in security
- 44:18Business continuity planning for incidents
- 48:57Developer perspective on shift left
- 52:09Closing remarks and resources
related talks
39mSoftware Supply Chain Security
15mSoftware Supply Chain Security for those in a rush
15mSupply chain security for dummies
25mSupply Chain Attacks
22mSofware Supply Chain Security Is Hard. But Does it Need to Be?
37mSupply Chain Attacks and the Future of Software Delivery
46mApplication security from start to finish
25mYour Software Supply Chain is Only as Secure as its Weakest Link