Benchmarking the Security of Your Software Supply Chain
summary
Claims an open source CLI called chainbench automates a CIS Benchmark for the software supply chain, scanning GitHub repos and CI for concrete failures (missing MFA, overly permissive base permissions, no secret scanning) and reporting 36 checks implemented so far with links to Aqua AVD. Demo shows fixes (enable MFA, change base permission to read, add vulnerability scanner, branch protection) and rescans turn red checks green. Roadmap promises broader coverage, SBOM checks and full CIS Benchmark publication and a public release in about two weeks.
AI-written summary · about
chapters (5)
- 0:00Start
- 2:04Quick Intro
- 3:54So what is the Software Supply Chain?
- 5:59The change
- 15:33The case of check-spelling
related talks
38mSecuring the chains: Building defensive layers for software supply chains
22mSofware Supply Chain Security Is Hard. But Does it Need to Be?
30mSupply Chain Security for OpenSource Projects
25mYour Software Supply Chain is Only as Secure as its Weakest Link
45mSponsored Session: Because Security Matters: Securing Your Open Source Supply Chain
41mManaging the Risk of Software Supply Chain Attacks
23mMastering Secure Software Supply Chains
27mSecuring the Software Supply Chain: Integrating OpenSSF Scorecard, Jenkins, and the O...