Learning from Supply Chain Failures and Best Practices in Other Industries
summary
Software supply chain failures cost real money and lives: SolarWinds infects ~18,000 orgs with ~ $90M cleanup, a PHP git compromise forces a move to 2FA and hosted GitHub, Homebrew pull requests allow arbitrary code, log4j gives remote code execution across countless dependencies, the Peanut Corporation causes ~700 infections and 9 deaths, the Ever Given blocks Suez for 6 days with ~$60B ripple effects. Practical fixes include multi-level SBOMs, sign and automate SBOMs, admission controllers and zero trust verification, plus redundancy, chaos testing, automation and continuous dependency scanning.
AI-written summary · about
chapters (5)
- 0:00Start
- 5:06Non-Software Supply Chain concepts Some apply, some don't.
- 6:28Traceability and Transparency
- 9:22Logistics Traversing the supply chain...
- 16:30Knowing where your dependencies are from And where their dependencies are from...
related talks
36mBuilding a Trusted and Resilient Software Supply Chain
39mSoftware Supply Chain Security
15mSoftware Supply Chain Security for those in a rush
37mSupply Chain Attacks and the Future of Software Delivery
58mAttacking through the Software Supply Chain
25mSupply Chain Attacks
41mHow to protect your software project from supply chain security threats
38mSupply Chain Security & the Real World: Lessons From Incidents