Supply Chain Security, SBOMs and How OSPOs Can Play An Important Role Going Forward - An Ecosystem and Compliance Update
Talkat Open Source Summit North America 2022 · on Thursday, 2022-06-23· at 16:05· Room 301/302 (Level 3), JW Marriott Austin, 110 E 2nd Street Austin, TX 78701·
summary
Government pressure after SolarWinds and a White House EO drives an industry push: enterprises move from ~80 to ~500 bundled OSS packages per app, and 84% of OSS projects have vulnerabilities (avg ~150 per codebase). Practical outputs include produce SBOMs but don’t publish them yet — use them to remediate, tooling like SLSA/Salsa scorecards, Sigstore and AlphaOmega, and an OpenSSF mobilization with ~$30M pledged. OSPOs coordinate data schemas, CI/CD integrity checks and cross‑org remediation; IBM-scale teams already digest ~150 billion security events/day for ~17,000 clients.
AI-written summary · about
chapters (10)
- 0:00Intro
- 1:10Cybersecurity and Regulatory Compliance
- 4:17Complex Interplay: Cybersecurity & Regulatory Compliance
- 6:42Evolution of Enterprise Software Supply Chain
- 10:18Source Integrity and Build Integrity Are Critical
- 11:24Last Fall LF Relaunched Open Source Security Foundation
- 15:29Open Source Security Foundation Working Groups
- 19:47What Are SBOM Minimum Requirements?
- 23:13Open Source Software Security Mobilization Plan
- 26:21How OSPOs Can Play an Important Role Going Forward
related talks
12mKeynote: DevSecOps and the Art of Not Ending Up On the Front Page
26mLooking at Open Source Security from the Community Angle
37mSecuring OSS across the whole supply chain and beyond
40mPractical guides for enhacing your Software Supply Chain Security
11mOSS Supply Chain Security
51mA Roadmap for Your OSS Security Lifecyle Journey to Protect Customers
11mSupply Chain Cybersecurity
46mOSS Management & OSPO Ask Anything