The Data Behind DevSecOps: The Power of Hindsight to Protect your Supply Chain
summary
Claims that data can harden supply chains by combining repository telemetry, CI gates and artifact provenance into automated policy enforcement and monitoring. Uses repository proxies (Nexus/Artifactory), CI checks, go mod commit hashes, vulnerability scanning and SBOM-style tracking to block known-malicious packages, highlight transitive risk and trigger deployments. Shows surprising magnitudes: 80–90% open source in modern apps and $3.4M from Jenkins miners, cites incidents like dependency confusion (July 2020) and Codecov to argue for sub-10‑day response windows.
AI-written summary · about
chapters (5)
- 0:00Start
- 3:53Not all parts are created equal
- 17:24Dependency confusion timeline
- 25:07TIME TO RESPOND BEFORE EXPLOIT
- 35:55The rising tide of regulation and software liability
related talks
22mSofware Supply Chain Security Is Hard. But Does it Need to Be?
30mSecuring DevOps using OWASP DevSecOps Tools
49mMitigate Risks In Code: Protect Your Software based Supply Chain
37mSupply Chain Attacks and the Future of Software Delivery
15mSupply chain security for dummies
12mKeynote: DevSecOps and the Art of Not Ending Up On the Front Page
22mGuardians of Code: Continuously Monitoring Security and DevOps Compliance
39mSoftware Supply Chain Security