Keynote: Supply Chain Security in 2024
summary
Supply chain attacks rise sharply — a ReversingLabs timeline shows a 1300% increase in certain supply-chain incidents in 2023, with high-profile compromises like SolarWinds and Log4Shell and “2 billion devices impacted” in one embedded OS case. The concrete defenses demonstrated are generating and attaching SBOMs and SLSA-style provenance, signing artifacts via sigstore transparency logs and cosign-like signers, running automated vulnerability scanning, and running a private, declarative package registry (the BSA/BSF-style project) to enforce vetted base images and reproducible builds.
AI-written summary · about
chapters (11)
- 0:00Supply chain security threats
- 3:05Supply chain attacks surge
- 6:41Software vs food supply risks
- 8:29Missing metadata in supply chains
- 11:42SBOMs for dependency tracking
- 13:07SBOM benefits for compliance
- 14:31Shift security left with trusted images
- 15:12Signing software artifacts
- 16:15SBOM and vulnerability tools
- 17:40Regulations and open source security
- 18:00Summary and call to action
related talks
39mSoftware Supply Chain Security
15mSoftware Supply Chain Security for those in a rush
37mSupply Chain Attacks and the Future of Software Delivery
40mPractical guides for enhacing your Software Supply Chain Security
12mKeynote: DevSecOps and the Art of Not Ending Up On the Front Page
29mSupply Chain Security: Threats, Defenses And What You Can Do
12mKeynote: A Vision for a Secure Software Supply Chain
15mSupply chain security for dummies