Software development and vulnerability management to secure the supply chain
summary
Examines how supplier compromises like SolarWinds and SITA spread to customers and describes Thales’ collective vulnerability program combining supplier audits, contractual clauses, and operational patching. The program mandates SBOMs, code signing, automated SCA and static/dynamic analysis in CI/CD, enforces risk-based patch prioritization, and requires deployment traceability, citing drivers such as NIS2, the US executive order, and forthcoming EU product certification.
AI-written summary · about
chapters (11)
- 0:00Supply chain introduction
- 2:28SolarWinds attack example
- 5:15Underestimated supply chain risks
- 8:04Vulnerability management strategy
- 11:38Secure software production
- 16:13Supplier collaboration
- 23:01Attack readiness and investigations
- 26:10Vulnerability inventory and classification
- 31:30Certification and BCM
- 32:55Geopolitical context and threats
- 36:02Q&A
related talks
39mSoftware Supply Chain Security
29mSupply Chain Security: Threats, Defenses And What You Can Do
29mState of the secure software supply chain
50mSoftware Supply Chain: Panel on Threat Intel, Trends, Mitigation Strategies
15mSoftware Supply Chain Security for those in a rush
37mSupply Chain Attacks and the Future of Software Delivery
41mSupply Chain Armoring: Tools and Techniques for Open Source Projects
12mKeynote: DevSecOps and the Art of Not Ending Up On the Front Page