.NET supply chain: Protecting against hidden threats
summary
Covers concrete defenses: run Trivy for licenses and SBOMs, use dotnet list package and NuGet audit (defaults changed in .NET 9.02 to include transitive items), commit the restore log file and build with restore log mode to fail on altered hashes, enforce package source mapping plus trusted signers and claimed NuGet prefixes to stop typo‑squatting and dependency‑confusion, and push CycloneDX/SPDX SBOMs into DependencyTrack for continuous monitoring. Calls out real risks (Log4J, a malicious NuGet in Feb this year), 70–90% reuse rate, and examples like is-odd (700k weekly downloads).
AI-written summary · about
chapters (19)
- 0:00.NET supply chain security
- 2:24Dependency confusion attacks
- 3:07Supply chain attack examples
- 5:12EU Cyber Resilience Act
- 9:05Software supply chains
- 11:53Detecting .NET vulnerabilities
- 16:06License compliance risks
- 20:23Supply chain risk strategies
- 24:42Dependency confusion attacks
- 30:06Preventing dependency confusion
- 33:38Trusted signers and mapping
- 35:26Claiming package prefixes
- 38:59Reproducible .NET builds
- 40:45Restore log files for security
- 43:17Secure .NET build configs
- 46:31Secure software by design
- 47:36SBOM and observability
- 50:26Prioritizing vulnerabilities with VEX
- 52:10Summary of protections
related talks
57m.NET supply chain: Protecting against hidden threats
46m.NET supply chain: Protecting against hidden threats
58mSecuring your .NET application software supply-chain
58mSecuring your .NET application software supply chain
48mYour .NET App Is Probably Vulnerable Right Now
58mThe Rise of Software Supply-Chain Attacks – How Secure is your .NET Application?
27m.NET Supply Chain Beneath the Surface
57mThe Rise of Software Supply-Chain Attacks – How Secure is your .NET Application?