Code, Dependencies and Security: Where Is the Risk
summary
The talk examines concrete supply-chain risks in build tools, package repositories and container images, citing examples like a Kubernetes Ingress flaw (CVSS 9.8) enabling RCE, hijacked libraries (e.g., Xutils) and typosquatting OpenJDK images. Recommended defenses include scanning images with Trivy, generating signed SBOMs, minimizing dependencies, and regularly patching Kubernetes and ingress controllers.
AI-written summary · about
chapters (13)
- 0:00Introduction
- 1:05Software supply chain
- 3:12Dependencies and risks
- 8:32Supply chain attacks
- 10:19SolarWinds attack impact
- 11:44XZ Utils SSH attack
- 13:11Container image risks
- 14:57Type squatting in code
- 16:00Vulnerability analysis tools
- 18:12NVD vulnerability database
- 20:00Kubernetes security updates
- 21:05Kubernetes critical flaw
- 23:57Summary
related talks
14mSupply Chain Security, why should I care?
09mKeynote: Supply Chain: The New Threat Vector in Cloud Native Security
15mSupply chain security for dummies
38mSupply Chain Security & the Real World: Lessons From Incidents
49mMitigate Risks In Code: Protect Your Software based Supply Chain
41mManaging the Risk of Software Supply Chain Attacks
29mSecuring the Unseen: Defending Against Open Source Software Supply Chain Attacks
18mContinuous Security - Building Security into your Pipelines