The Supply Chain Conundrum: Why Traditional Application Security Is...
summary
Claim: vulnerability-focused tooling misses unrecognized risk that averages 4.5 years between bug introduction and fix, while recognized risk is only ~3 months. Evidence: Heartbleed, Apache Struts/Equifax, Log4Shell as multi-year exposures. Attack examples: npm node-ipc adds region checks and deletes files; typo-squatting (pumpy vs pumpyio) with malicious dependency red_aptly. Built and used: scanner engines and threat-hunting pipelines (Checkmarx reports 200,000+ malicious packages), OpenSSF scorecard and package-zoo efforts aim to flag and block these before installation.
AI-written summary · about
chapters (14)
- 0:00Supply chain security intro
- 2:05Traditional appsec fails
- 5:39Trust paradox in open source
- 7:28Notorious OSS vulnerabilities
- 10:18Unrecognized supply chain risks
- 13:09Reactive security approaches
- 15:18Proactive OSS hardening
- 17:25Malware in open source
- 18:29Case study: Brandon’s npm package
- 22:45Typosquatting attacks
- 26:36Malware vs vulnerabilities
- 28:04Key takeaways
- 29:08Open source as a blessing and a curse
- 32:45Q&A
related talks
34mStranger Danger: Finding Security Vulnerabilities Before They Find You!
32mBuilding a secure future using DEVSECOPS practices and technologies
51mOSS Supply Chain Threats and Why You Need a Holistic Security Strategy
41mThe Divine and Felonious Nature of Cyber Security
40mEmbracing Security - A Changing DevOps Landscape
14mSupply Chain Security, why should I care?
16mAre We Forever Doomed to Software Supply Chain Security?
13mKeynote: Hacking the OSS Supply Chain