Keynote: Supply Chain: The New Threat Vector in Cloud Native Security
summary
Cloud native attack surface shifts from runtime exploits to tampering with dependencies and developer tooling, exemplified by SolarWinds and rising typo squatting and abandoned-package takeovers. Public registries and IaC templates (Terraform, CloudFormation, Kubernetes manifests) can be poisoned, generating thousands of alerts that lack good triage. Recommended defenses include static analysis, dependency inventory, and tying build/deploy/run with a cohesive declarative policy language — practical tools mentioned include kube-linter and shift left practices to catch issues earlier and reduce risky images and configs.
AI-written summary · about
chapters (6)
- 0:00Introduction
- 2:31Vulnerability Management
- 4:03Declarative Approach
- 5:29Dependencies
- 6:22typo squatting
- 7:35why supply chain security
related talks
25mSupply Chain Attacks
32mHacking the Cloud Native Renaissance: Lowering Risk of Kubernetes Adoption
34mUntrusted Execution: Attacking the Cloud Native Supply Chain - Francesco Beltramini
56mNavigating the Cloud Native Security Landscape
28mCode, Dependencies and Security: Where Is the Risk
37mSupply Chain Attacks and the Future of Software Delivery
36mBack to the Future in the Space of Cloud Native Security
37mUntrusted Execution: Attacking the Cloud Native Supply Chain