A Different Kind of S3: First Line Security of the Supply Chain
summary
Three practical defenses claim to cut supply chain risk: generate s-bombs (machine‑readable SBOMs stored in artifact stores or S3 for retrospective inventories), sign artifacts with systems like sigstore to create cryptographic provenance, and apply automated slimming during CI/CD (docker‑slim style) to remove unnecessary libraries and shrink images, yielding fewer vulnerabilities, faster pipelines and lower cloud bills; add sharing of findings across teams and vendors, with Gartner data showing only 52% CTO–CSO and 29% CTO–CDO regular engagement.
AI-written summary · about
chapters (4)
related talks
18mA Different Kind of S3: First Line Security of the Supply Chain
18mA Different Kind of S3: First Line Security of the Supply Chain
15mSoftware Supply Chain Security for those in a rush
41mSupply Chain Armoring: Tools and Techniques for Open Source Projects
38mSecuring the chains: Building defensive layers for software supply chains
38mChallenge Accepted: 3 Experts, 3 Big Ideas on Supply Chain Security
15mSupply chain security for dummies
37mSecuring OSS across the whole supply chain and beyond