Software Supply Chain Aspects in Infrastructure as Code, and How to Secure it
Talkat ContainerCon @ Open Source Summit Europe 2022 · on Friday, 2022-09-16· at 10:50· Wicklow Hall 2A (Level 2), Convention Centre Dublin, Spencer Dock, N Wall Quay, North Wall Dublin 1, D01 T1·
summary
Claims that tens to thousands of malicious npm/pypi clones exist (example: 1000 malicious packages), shows artifact repositories and Docker Hub results are ambiguous and prone to typo‑squatting, and demonstrates that scanners often miss payloads because they rely on reported package metadata (container scanners miss hidden installs). Recommends reproducible builds, verifying Dockerfiles and base images, and using an IaC scanner like KICS IaC scanner integrated into CI to block risky Helm charts and Dockerfiles; practical checks include ensuring access to and provenance of Dockerfile sources.
AI-written summary · about
chapters (10)
- 0:00Software Supply Chain
- 0:55Software Security
- 10:41Supply Chain Security & Containers
- 12:19Find a HELM chart
- 15:06Levels of Typosquatting
- 18:10Container Supply Chain
- 25:58The importance of metadata
- 30:31Distroless containers
- 32:31Reproducibility
- 35:20Securing Container Creation
related talks
37mSoftware Supply Chain Aspects in Infrastructure as Code
45mPractical Software Supply Chain Security Solutions
06mRethinking the Software Supply Chain: Trust, Minimalism, and Resili...
01h 02mProtect Yourself Against Supply Chain Attacks
15mSupply chain security for dummies
38mSecuring the chains: Building defensive layers for software supply chains
41mManaging the Risk of Software Supply Chain Attacks
37mSponsored Session: The Simple, Yet Lethal, Anatomy of a Software Supply Chain Attack