Let’s Talk Software Supply Chains with TAG Security
summary
Outputs include the Software Supply Chain Security Whitepaper, a living catalog of supply chain compromises with dozens of writeups, and a Secure Software Factory reference architecture with a Fresca demo implementation. Practical tooling and patterns named: Sigstore for signing, SPIFFE/Spire for workload identity, eBPF for build introspection, and a public spreadsheet mapping best-practice controls to open-source tools. Work gets cited by NIST SSDF and the group runs weekly meetings and an OSS survey to prioritize next steps.
AI-written summary · about
chapters (5)
- 0:00Start
- 1:00What is TAG Security
- 5:08Software Supply Chain Security Best Practices
- 10:05Secure Software Factory
- 18:33How Can You Get Involved?
related talks
17mKeynote: TAG Security, You're It!
49mThe Secure Software Supply Chain
32mSoftware Supply Chain Security
32mStaring Into the Abyss with the Security Technical Advisory Group
46mPanel Discussion: Ketchup, Mustard, and Relish of Software Supply Chain Security
33mWhat is the secure software supply chain
12mKeynote: A Vision for a Secure Software Supply Chain
29mState of the secure software supply chain