Your Software Supply Chain is Only as Secure as its Weakest Link
Talkat Open Source Summit Europe 2023 · on Wednesday, 2023-09-20· at 11:25· Room 0C (Floor 0), Abandoibarra Etorb., 4, 48011 Bilbao, Bizkaia, Spain·
summary
Argues that open source transitive dependencies and missed patches are the real attack vectors, not cinematic zero-days, and prescribes concrete steps: maintain an SBOM as live inventory, run weekly “fire‑drill” tests of your patch/incident plan, deploy real‑time monitoring across the CI/CD chain, and build a team of DevSecOps champions to reduce tool overload. Flags legal and quality risks of AI-generated code, cites the May 2021 US executive order and upcoming EU Resilience Act as drivers for action.
AI-written summary · about
chapters (21)
- 0:00Software supply chain risks
- 1:11Technology complexity gaps
- 3:21Developers struggle with security
- 5:33Open source dependencies risks
- 7:44Ignoring updates costs
- 9:10Hackers exploit weaknesses
- 10:54Connected risks in smart world
- 11:39AI coding helpers breach points
- 12:01Government SBOM mandates
- 13:49License risks and vulnerabilities
- 14:53Software licensing pitfalls
- 16:19Can SBOM alone prevent software mistakes
- 17:03DevOps security integration
- 18:30Aligning people processes tech
- 19:11Security measuring stick
- 20:15Testing security plans
- 21:20Real-time monitoring response
- 22:01Training security champions
- 22:43Company security culture
- 23:48Steps to secure supply chain
- 24:29Monitoring evolving threats
related talks
25mYour Software Supply Chain is Only as Secure as its Weakest Link
41mManaging the Risk of Software Supply Chain Attacks
39mOpen Source Software Supply Chain Security — Why does it matter?
44mKeeping Your Software Supply Chain Healthy
22mSofware Supply Chain Security Is Hard. But Does it Need to Be?
37mSupply Chain Attacks and the Future of Software Delivery
49mMitigate Risks In Code: Protect Your Software based Supply Chain
39mSoftware Supply Chain Security