The role of CDEs in securing your software supply chain
summary
Recommends starting by generating an SBOM (SPDX) for every build and treating that SBOM as an immutable record tied to the released artifact; cites the US cyber order and EU rules pushing this requirement. Advises using SCA tools, provenance metadata and threat modeling — the Linux Foundation funds audits (about $250k spent on Kubernetes) — and adopting a mix of airport and casino models for enforcement and telemetry across millions of transitive dependencies.
AI-written summary · about
chapters (10)
- 0:00Introduction
- 2:33Software supply chain
- 6:50Critical step for security
- 9:41Open source security
- 15:11Secure development tools
- 17:31Securing open source at scale
- 20:04Security models for teams
- 22:51Developer apathy in security
- 24:48AI tools policy
- 26:35Provenance and AI usage
related talks
32mSoftware Supply Chain Security
23mMastering Secure Software Supply Chains
23mSupply Chain Security using Free and Open Tools
38mSecuring the chains: Building defensive layers for software supply chains
37mSecuring OSS across the whole supply chain and beyond
25mYour Software Supply Chain is Only as Secure as its Weakest Link
14mKeynote: The Next Steps in Software Supply Chain Security
44mKeeping Your Software Supply Chain Healthy