Securing Open Source in Nomura’s Software Supply Chain
summary
Built a Raspberry Pi home‑automation prototype and aborted after an NPM install pulls thousands of transitive packages, sparking an audit with Sonatype that reveals worrying supply‑chain numbers: 11M of 23M bouncycastle downloads contain the old TLS bug, ~18M of 23.5M commons‑collections downloads were vulnerable (78%) and one in eight Maven Central downloads had a vulnerability by 2017. Implements policy gates visible in developer UI, license checks, automated upgrade suggestions (advise “upgrade three versions” to fix a flagged Struts vuln), and pilots via tech fairs and live repo scans.
AI-written summary · about
chapters (6)
- 0:00Start
- 1:22Raising Digital Awareness
- 3:43Hackathon
- 9:28Commons Collection Vulnerability
- 10:02Cyber Security Hygiene Ratio
- 14:01A Lean Business Case
related talks
31mOpen Source Supply Chain Threat Landscape - A Moving Target
41mSponsored Session: Software Supply Chain Threat Landscapes: A Moving Target
13mKeynote: Hacking the OSS Supply Chain
25mTrusting Your Open-Source Software Supplier
42mHacking the OSS Supply Chain
37mIt’s Not Open Source, It’s You. Where Open Source Risk Comes From
41mManaging the Risk of Software Supply Chain Attacks
13mKeynote: Hacking the OSS Supply Chain