Keynote: A Vision for a Secure Software Supply Chain
summary
Sixty‑one percent of businesses report a supply‑chain hit (Gartner), and concrete incidents include a malicious backdoor in XZ packages, Dependabot impersonation that exposed repo secrets, and a Zoho chain of vulnerable dependencies. The ecosystem now stitches concrete tools together: intoto and SBOMs combined produce attestations that map build steps to components, TUF for secure distribution delivers layouts and delegations for verified policy, and graph tools like GUAC power queries — used in practice by Datadog and Horizon to verify end‑to‑end provenance.
AI-written summary · about
chapters (11)
- 0:00Software supply chain security
- 1:04Software supply chain attacks
- 2:05Supply chain compromise examples
- 3:27Progress in supply chain security
- 5:12Key open-source technologies
- 6:38Holistic supply chain approach
- 7:20Combining technologies for security
- 8:24Production use cases
- 9:05Future collaboration vision
- 10:30Call to action
- 11:11Conclusion and challenges
related talks
14mKeynote: The Next Steps in Software Supply Chain Security
08mKeynote: Security of the Open Source Supply Chain, a Call to Action
36mBuilding a Trusted and Resilient Software Supply Chain
12mKeynote: DevSecOps and the Art of Not Ending Up On the Front Page
19mKeynote: Supply Chain Security in 2024
16mKeynote: Securing Shopify's Software Supply Chain
33mWhat is the secure software supply chain
39mSoftware Supply Chain Security