Securing the Software Supply Chain: Integrating OpenSSF Scorecard, Jenkins, and the O...
summary
OpenSSF Scorecard scores plus Jenkins CI feed SBOMs into Ortelius which aggregates SBOMs to application level and maps each vulnerability to component and live endpoint, synchronizing with OSV.dev and synchronizes OSV.dev every 10 minutes to flag new issues. The system reports which packages (e.g., IDNA) run where, shows blast radius across apps, and plans auto-remediation (MCP server that updates pins and opens PRs). The claim: automating this pipeline cuts average response from ~100 days to under 10, handling ~40,000 supply‑chain vulnerabilities a year.
AI-written summary · about
chapters (8)
- 0:00Introduction
- 2:29OpenSSF Scorecard basics
- 7:47Ortilius post-deployment scans
- 13:02Scorecard data aggregation
- 15:12Threats and blast radius mapping
- 17:42Key takeaways and auto-remediation
- 19:26Tomorrow’s CI/CD security
- 20:30Q&A
related talks
42mAssessing the Risk of Open-source Components Using OpenSSF's Scorecard
51mA Roadmap for Your OSS Security Lifecyle Journey to Protect Customers
20mBuilding Secure Software OpenSSF Best Practices for Everyone!
36mSecuring the software supply chain
22mSofware Supply Chain Security Is Hard. But Does it Need to Be?
44mSecuring Open Source Software - End-to-End, at Massive Scale, Together
27mHow Do You Trust Your Open Source Software?
27mSecuring Open Source With SBOM: From Visibility To Trust