Managing Software Supply Chain Risks in a Large Organization
summary
Bloomberg lays out a practical supply chain program: generate and mirror SBOMs to inventory dependencies, scan with CycloneDX/ClearlyDefined data, use GUAC-style graphs to find deep transitive risks (Log4j-style reach), and shift left to intercept vulnerabilities. Corporate sustainability pairs funding with time: a quarter of a million dollars pledged to fast contributor funds in 2024 and a volunteer-match program with a $5,000 cap, plus a NumFOCUS-backed pandas eight-week Series that yielded 100+ hours and many commits.
AI-written summary · about
chapters (9)
- 0:00Introduction
- 1:26Open source at Bloomberg
- 4:18Supply chain risks defined
- 8:38Security and sustainability
- 10:00Sustaining open source projects
- 12:08Corporate funding for open source
- 15:02Sustainable open source ecosystems
- 16:49Collective security responsibility
- 26:44Q&A
related talks
49mScaling Software Supply Chain Source Security in Large Enterprises
08mKeynote: Approaching the SBOM: Best Practice for Software Supply Chain Security
44mKeeping Your Software Supply Chain Healthy
41mManaging the Risk of Software Supply Chain Attacks
41mSupply Chain Armoring: Tools and Techniques for Open Source Projects
49mMitigate Risks In Code: Protect Your Software based Supply Chain
25mYour Software Supply Chain is Only as Secure as its Weakest Link
30mLearning from Supply Chain Failures and Best Practices in Other Industries