Practical guides for enhacing your Software Supply Chain Security
summary
Claims a 650% rise in OSS supply‑chain attacks (2021), 81% of commercial code having OSS vulnerabilities, and that ~45% of orgs face supply‑chain attacks by 2025. Shows a live flow: build an OCI image, sign it with cosign using a KMS key, publish signature to a transparency log, and enforce deployment with a Kubernetes admission controller that blocks unsigned images. Covers provenance and SBOM generation, and cites SolarWinds, Log4j and intentional XZ backdoor incidents as concrete failure modes.
AI-written summary · about
chapters (21)
- 0:00Software supply chain security intro
- 1:07What supply chain security means
- 2:32Supply chain attack consequences
- 4:58Maersk breach case study
- 7:50Coop supermarket attack
- 9:14Vulnerable packages risks
- 11:22XZ backdoor infiltration
- 12:46Attack vectors in supply chains
- 13:49Zero trust and shift left
- 14:52Sigstore for artifact signing
- 15:34SLSA framework overview
- 16:38Cosign and Rekor tools
- 19:07SBOM explained
- 21:36EU NIS2 and SBOM rules
- 22:19Live demo: Container image signing
- 25:29Risks of unsigned images
- 26:56Cosign in action
- 28:47Signature verification in registries
- 30:50Kubernetes supply chain policies
- 31:54Admission controllers
- 34:25Closing thoughts & Q&A
related talks
07mHow to Secure Your End-to-end Supply Chain
11mSupply Chain Cybersecurity
37mSupply Chain Attacks and the Future of Software Delivery
37mSecuring OSS across the whole supply chain and beyond
19mKeynote: Supply Chain Security in 2024
39mSoftware Supply Chain Security
39mOpen Source Software Supply Chain Security — Why does it matter?
41mManaging the Risk of Software Supply Chain Attacks