As Strong As the Weakest Link: Securing the Software Supply Chain
summary
SolarWinds compromise shows attackers breach a vendor’s CI/CD build infrastructure, inject DLLs (Sunspot) then deliver a trojanized payload (Sunburst), remove traces and later activate the backdoor to reach customers; evidence includes tampered signed builds and staged testing of payloads. Presentation surveys mitigation tools like Helm & Porter and Cloud Custodian, recommends hardening build signing, strict artifact provenance, and isolating build runners so a single compromised dependency cannot cascade into production.
AI-written summary · about
chapters (4)
- 0:00Start
- 4:06The Supply Chain Risk Management Report
- 9:12Transitive Dependency
- 12:03What Is a Supply Chain
related talks
39mReflections on Trust in the Software Supply Chain
29mState of the secure software supply chain
54mSupply Chain Security for OpenSource Projects
57mThe Secure Software Supply Chain
41mHow to protect your software project from supply chain security threats
15mSoftware Supply Chain Security for those in a rush
29mSupply Chain Security: Threats, Defenses And What You Can Do
37mThe SolarWinds Hack and the Executive Order on Cybersecurity happened