Software Supply Chain for the SDV Future — Logistics, Cybersecurity and Compliance
summary
Claim: SDVs push OEMs to treat software like hardware with component-level SBOMs and automated CI/CD certification; many teams build pipelines that generate SPDX manifests and evidence so images can be rebuilt and verified. Surprising metrics: some vendors patch in 45 days, Tesla-style verification reaches 24‑hour certification, and analysts expect 50% of vehicle bill of materials by 2030. Proven approach is bottom-up verification, DevSecOps pipelines, and automated artifact generation rather than late-stage auditing.
AI-written summary · about
chapters (10)
- 0:00Introduction to software defined vehicles
- 3:13Software evolution in cars
- 7:29Safety and security challenges
- 11:22Attack vectors and vulnerabilities
- 15:58Patching delays in SDVs
- 18:04System engineering and V-model
- 21:33Metadata for supply chains
- 25:24SBOM minimum elements
- 28:14Certification in pipelines
- 31:43Q&A on automotive practices
related talks
46mRevolutionizing Automotive Software: DevSecOps, Functional Safety, and Open Source Sy...
19mMeasure and Improve Software Supply Chain Assurance with OWASP SCVS
14mKeynote: The Next Steps in Software Supply Chain Security
52mSoftware Supply Chain Lifecycle Management
22mTop 5 Reasons (and 5 Myths Debunked) to Invest in Securing the Software Supply Chain
28mThe role of CDEs in securing your software supply chain
37mSecuring OSS across the whole supply chain and beyond
32mSoftware Supply Chain Security