Protecting your organisation against attacks via the build system
summary
Conference-level analysis of actual attacks and concrete defenses: dependency feeds contain intentional malware so quarter of NPM advisories are malicious and similar cases in Ruby; supply‑chain compromises can reach millions—CCleaner update hit 2M users but attackers targeted 40 companies. Practical mitigations include PR code review before CI, commit signing, isolated build agents with shared build cache, repository filtering and dependency locking, rejecting known vulnerable ranges, and tooling: the checksum‑dependency plugin and Gradle 6 adds sha‑256/512 and native checksum/signature verification.
AI-written summary · about
chapters (9)
- 0:00The threat of supply chains
- 3:08Analyzing dependency risks
- 8:12Real-world attack examples
- 13:13Securing CI infrastructure
- 18:04Implementing security measures
- 22:12Performance and build caching
- 26:56Integrity and verification
- 34:57Repository and transport safety
- 41:49Reproducible build strategies
related talks
46mProtecting Your Organization from Build-system Attacks
52mBest Practices for Developers to Master Security
01h 02mProtect Yourself Against Supply Chain Attacks
41mManaging the Risk of Software Supply Chain Attacks
54mSupply Chain Security for OpenSource Projects
35mSupply Chain Attacks: Focused on NPM attacks
49mMitigate Risks In Code: Protect Your Software based Supply Chain
49mWhat Hacking the Planet Taught Us About Defending Supply Chain Attacks