.NET supply chain: Protecting against hidden threats
summary
Modern .NET projects gain concrete defenses: NuGet audit (now reporting transitive vulnerabilities by default in .NET 10) and net list package reveal vulnerable packages; package source mapping plus prefix reservation and trusted signers block dependency‑confusion and typo‑squatting; a committed package log file plus restore log mode enforces hashes for reproducible builds. Use Trivy to scan licenses, emit an SBOM and FAX to prioritize 200→5 exploitable findings, and automate updates with NuGet package update — demos show these features working end to end.
AI-written summary · about
chapters (15)
- 0:00Introduction
- 3:00Supply chain attack examples
- 6:29Introduction
- 11:45Software supply chain risks
- 14:37Demo: Package vulnerability scanning
- 21:45License compliance risks
- 26:10Risk management strategies
- 29:23Dependency confusion attacks
- 37:11Trusted signers and typo squatting
- 39:21Reproducible .NET builds
- 45:51SBOM and vulnerability observability
- 49:09FAX files and exploitability
- 50:15SALSA framework
- 51:21Key takeaways
- 52:25Q&A
related talks
56m.NET supply chain: Protecting against hidden threats
46m.NET supply chain: Protecting against hidden threats
48mYour .NET App Is Probably Vulnerable Right Now
58mThe Rise of Software Supply-Chain Attacks – How Secure is your .NET Application?
57mThe Rise of Software Supply-Chain Attacks – How Secure is your .NET Application?
27m.NET Supply Chain Beneath the Surface
58mSecuring your .NET application software supply-chain
58mSecuring your .NET application software supply chain