Top 5 Reasons (and 5 Myths Debunked) to Invest in Securing the Software Supply Chain
summary
SBOM alone is not enough: the talk argues that ingredient lists (CycloneDX, SPDX, GitBom, Black Duck) require signed attestations, provenance and runtime observability, and must extend down into hardware and system integration. It presents a concrete architecture — a secure ledger with confidential computing using Intel SGX VMs on Azure, decentralized IDs, claims plus receipts — that guarantees identifiable issuers, immutability and verifiable receipts. It cites $6T cyber costs in 2021 (rising toward $10.5T by 2025) and notes about continuous attestation not one‑off compliance.
AI-written summary · about
chapters (7)
- 0:00Intro
- 2:58Supply Chain - in context
- 7:23SBOM - peeling the onion
- 9:35Myth: SBOM - Create one and you are done
- 12:35SCITT Overview
- 14:51SCITT Architecture
- 19:04Myth: I can use willpower alone to push through the difficult days
related talks
37mSecuring OSS across the whole supply chain and beyond
14mKeynote: The Next Steps in Software Supply Chain Security
12mKeynote: A Vision for a Secure Software Supply Chain
08mKeynote: Approaching the SBOM: Best Practice for Software Supply Chain Security
37mUntrusted Execution: Attacking the Cloud Native Supply Chain
22mSofware Supply Chain Security Is Hard. But Does it Need to Be?
29mState of the secure software supply chain
23mMastering Secure Software Supply Chains