What Good Is SCA If You Depend on 666 Packages?
summary
Talk examines weaknesses of relying on Software Composition Analysis (SCA) when a project depends on hundreds of packages. It discusses practical cybersecurity issues with large dependency trees and likely covers risks and mitigation strategies for projects that inherit many third-party components.
AI-written summary · about
chapters (13)
- 0:00Introduction to SCA
- 3:57How SCA works
- 9:55SCA limitations and attacks
- 15:22Supply chain attack examples
- 21:50Defending supply chain attacks
- 23:59Lock files and version pinning
- 26:07Private registries and repo firewall
- 28:11Behavioral risk scoring
- 28:55SBOM role in security
- 29:59Artifact signing
- 30:40Runtime security
- 31:42Hardening CI/CD
- 32:03Summary
related talks
30mWhat Is Going On In Your Source Code? Understanding SCA In Plain Language
23mPrioritisation of SCA Findings in Software Dependencies Using Static Reachability Analysis
46mSCA for Containers: The Good, the Bad, and the Truth- 46mSCA for Containers: The Good, the Bad, and the Truth
44mKeeping Your Software Supply Chain Healthy
45mPractical Software Supply Chain Security Solutions
44mA Warrior's Journey Building a Global AppSec Program
23mSBOM adopatability in open source software scanning