Protecting Customers Through Smarter OSS Management
summary
Dell shows how it built a central dependency management platform (DMP), ingests SCA outputs, scores components with an OpenSSF‑derived trustworthiness score, and enforces a green zone of pre‑approved packages so teams shift left. The pipeline auto‑produces customer SBOMs, exposes a customer‑facing vulnerability UI, and links inventories to vulnerability‑response tickets and supplier risk data. Workflows now track end‑of‑security‑life, use AI (Mythos, CodeGuardian, Project Glasswing) for hunting/prioritization, and meet EU CRA and customer SBOM demands.
AI-written summary · about
chapters (17)
- 0:00OSS management at Dell
- 1:48Rising threats in OSS supply chain
- 6:23Dell’s OSS trustworthiness roadmap
- 11:01SDL controls for dependencies
- 12:27From licensing to vulnerability response
- 16:40Dependency management platform
- 19:30Trustworthiness scores for OSS
- 23:22Dell’s green zone model
- 26:09Security left in CI/CD
- 27:35Inventory and vulnerability tracking
- 30:25Product risk dashboard at release
- 31:50Beyond inventories with AI
- 35:01AI’s impact on OSS security
- 36:45Key takeaways and future directions
- 37:27Q&A: Fork or replace decisions
- 39:58Q&A: End-to-end risk visibility
- 42:46Q&A: AI coding and dependencies
related talks
40mManaging Risk Across the Vulnerability Ecosystem
51mA Roadmap for Your OSS Security Lifecyle Journey to Protect Customers
27mSecuring the Software Supply Chain: Integrating OpenSSF Scorecard, Jenkins, and the O...
28mThe role of CDEs in securing your software supply chain
23mSupply Chain Security using Free and Open Tools
54mSupply Chain Sec /w Dependency Track
37mSecuring OSS across the whole supply chain and beyond
30mSecuring DevOps using OWASP DevSecOps Tools