A Roadmap for Your OSS Security Lifecyle Journey to Protect Customers
summary
Dell teams build an executive Product Security Operations Committee and an Open Source Assurance Program, integrate inventories into a single aggregator, ingest supplier SBOMs and publish false‑positive advisories so SBOM-driven vulnerability response triggers automated tickets and impact assessments. They adopt Microsoft’s secure supply chain consumption framework via OpenSSF, run scorecard and scanning tools, use VEX and CVSS with contextual overlays, and report that with 98% of codebases using OSS and 92% containing outdated components this platform accelerates fixes and wins executive ESG backing.
AI-written summary · about
chapters (15)
- 0:00Welcome
- 1:04Speaker intros
- 3:33OSS security roadmap
- 4:35Vulnerability response challenges
- 5:39Executive support strategies
- 9:13Mature OSS security
- 10:38Dell's OSAP program
- 12:41S2C2F framework
- 14:49OpenSSF tools overview
- 16:12OpenSSF workflow integration
- 17:15Vulnerability response improvement
- 19:02SBOMs role and challenges
- 24:20Dependency management workflow
- 29:14Course-correcting OSS security
- 33:03Question and answer session
related talks
44mProtecting Customers Through Smarter OSS Management
27mSecuring the Software Supply Chain: Integrating OpenSSF Scorecard, Jenkins, and the O...
34mSupply Chain Security, SBOMs and How OSPOs Can Play An Important Role Going Forward - An Ecosystem and Compliance Update
40mManaging Risk Across the Vulnerability Ecosystem
40mPractical guides for enhacing your Software Supply Chain Security
11mSupply Chain Cybersecurity
52mOSS Security Maturity: Time to Put on Your Big Boy Pants!
39mOpen Source Software Supply Chain Security — Why does it matter?