Is the Internet on Fire? Strategies for Mitigating Open Source...
summary
Open source packages repeatedly carry real-world implants and zero days (Log4Shell, Sunburst, typo‑squatting) that bypass CI and SCA; defenders build an asset inventory, sign and verify artifacts with sigstore signing, and ingest SBOMs into a graph-based analyzer like guac 1.0 to map dependencies to CVEs. Concrete controls include salsa build practices, in-toto/TUF policy for provenance, admission controllers that block known bad container hashes, and routine purple‑team exercises to validate detection and response.
AI-written summary · about
chapters (7)
- 0:00Introduction
- 2:51Open source security threats
- 7:03Supply chain attacks in practice
- 13:22Mitigating open source risks
- 18:41Defending against zero days
- 23:42OpenSSF and CNCF projects
- 30:02AI supply chain security
related talks
29mSecuring the Unseen: Defending Against Open Source Software Supply Chain Attacks
18mIT Security – Don’t let Open Source Software become the next menace
30mOpen Source Malware or a Vulnerability? The Philosophical Debate and How To Mitigate
54mSupply Chain Security for OpenSource Projects
41mSupply Chain Armoring: Tools and Techniques for Open Source Projects
36mOur dependency on Open Source is scary. SLSA, SBOM and Sigstore to the rescue
41mManaging the Risk of Software Supply Chain Attacks
41mHow to protect your software project from supply chain security threats