Uncovering Software Provenance in Embedded Systems
summary
Embedded devices adopt container-based, signed immutable payloads so fleets become verifiable; Pantacor builds pantavisor and uses state revisions to list exact components and cross-reference SBOM vulnerability feeds (mentions Snyk and “Riven Era”) so devices with 16–64 MB flash can be flagged. Cites Colonial Pipeline fallout (May 2021, ~75 BTC paid, fuel shortages across a dozen+ states, 4–5 days downtime) as the driver for software bill of materials linking discovery to automated mitigations like air‑gapping or disabling vulnerable modules.
AI-written summary · about
chapters (4)
- 0:00Start
- 2:17Software Provenance?
- 6:25Embedded Systems Security
- 8:55More Frequent Attacks: Colonial Pipeline ransomware
related talks
29mFragile by Design: Large-Scale Evidence of Supply Chain Risk
39mSecure Your Supply Chain: Adding a Software Bill of Materials to Your Containers to Improve...
30mBroken Links: Emergence and Future of Software-Supply Chain Compromises
36mBuilding a Trusted and Resilient Software Supply Chain
38mSecuring the chains: Building defensive layers for software supply chains
22mTop 5 Reasons (and 5 Myths Debunked) to Invest in Securing the Software Supply Chain
30mTaking Control of Cyber-Supply Chain Security
41mHow to protect your software project from supply chain security threats