Securing the Modern Software Supply Chain: A Beginner’s Guide To SLSA, SBOM, and Beyond
Talkat Cloud Native University 2025 · on Tuesday, 2025-04-01· at 11:15· Level 0 | ICC Capital Hall | Room J·
summary
Explains concrete controls and tools to stop dependency-led compromises: SLSA v1.0 requirements like 2FA, mandatory two reviewers, no anonymous PRs and PR labels to gate runners; cosign, Rekor, Fulcio for artifact signing and transparency logs; and SBOM generation to list every dependency. Cites SolarWinds as a precedent that affected ~18,000 customers and describes a practical response process—sustaining teams that patch or rebuild images to remove CVEs—rather than abstract best practices.
AI-written summary · about
chapters (8)
- 0:00Software supply chain intro
- 2:08Why modern chains are vulnerable
- 3:55Real-world supply chain attacks
- 5:43Securing the supply chain
- 8:12SLSA for build security
- 10:18Sigstore for artifact signing
- 12:24SBOMs as ingredients list
- 13:27Q&A
related talks
43mOur Dependence on Open Source Is Scary. SLSA, SBOM and Sigstore to the Rescue
30mSecuring Open Source Supply Chains
43mSLSA, SigStore, SBOM & Software Supply Chain Security. What does it all mean?
34mFrom development to release: Protecting the software supply chain
30mSupply Chain Security for OpenSource Projects
36mOur dependency on Open Source is scary. SLSA, SBOM and Sigstore to the rescue
35mPractical Guides for Enhancing Your Software Supply Chain Security
12mKeynote: DevSecOps and the Art of Not Ending Up On the Front Page