Supply Chain Sec /w Dependency Track
summary
Shows concrete results not buzz: ingest CycloneDX SBOMs from build tooling, correlate advisories from OSS Index Snyk and Google OSV, and present a full dependency tree so you can trace where a CVE appears. A Maven plugin uploads BOMs, fails builds when configured thresholds or policies hit, and scheduled scans run daily. Empirical numbers matter here: 78% OSS usage in studied codebases, ~30% still pull vulnerable Log4j a year later, and dependence on Dependency-Track Maven plugin plus the Hades scalable microservices effort proves it can run at enterprise scale.
AI-written summary · about
chapters (8)
- 0:00Supply chain security risks
- 9:23Inventory in software supply chains
- 17:11Accurate inventories with SBOMs
- 24:37Dependency-Track introduction
- 30:47Dependency-Track demo
- 44:07Zero-day attacks with policies
- 49:53Scaling Dependency-Track
- 50:18Q&A
related talks
24mDependency Track Fortifying The Supply Chain
46mSafely through the dependency minefield using OWASP Dependency Track
23mSupply Chain Security using Free and Open Tools
25mFlagship Projects: Dependency Track
14mSupply Chain Security, why should I care?
26mKnow Your Dependencies: A Guide to Automating Dependency Assurance
34mDependency Track
27mSecuring the Software Supply Chain: Integrating OpenSSF Scorecard, Jenkins, and the O...