Adapting DevOps in a World of Growing Software Supply Chain Attacks
summary
Shows concrete attack types—typosquatting, namespace confusion and direct malicious dependency injections—and quantifies risk: modern apps pull ~2.2 trillion downloads across ecosystems, about 20–29% of popular components are known vulnerable, and public exploits appear within three days of disclosure. Demonstrates controls used: Maven Central monitoring, Sonatype OSS Index and Dependency-Tracker, metrics like mean time to update, and an empirical recommendation to target roughly 2.7 versions behind as a pragmatic upgrade cadence.
AI-written summary · about
chapters (10)
- 0:00Intro
- 2:12What you will learn
- 3:00Why is there a new wave of cybersecurity attacks?
- 6:34Where do vulnerabilities enter your supply chain?
- 12:37Typosquatting
- 15:46Namespace confusion
- 18:06Malicious code injections
- 20:40How to prevent future attacks?
- 22:308 Rules
- 31:20Outro
related talks
31mOpen Source Supply Chain Threat Landscape - A Moving Target
41mSponsored Session: Software Supply Chain Threat Landscapes: A Moving Target
51mOSS Supply Chain Threats and Why You Need a Holistic Security Strategy
48mAn Introduction to the Newest Addition to the OWASP Top 10
41mManaging the Risk of Software Supply Chain Attacks
37mSupply Chain Attacks and the Future of Software Delivery
37mThe Death Star and the Ultimate Vulnerability
40mEmbracing Security - A Changing DevOps Landscape