Mitigate Risks In Code: Protect Your Software based Supply Chain
summary
Claims that supply‑chain attacks are rising and that keeping dependencies current avoids ~90% of newly discovered vulnerabilities and addresses issues in ~60% of breaches, recommends concrete tools: use Renovate to open PRs, show merge‑confidence stats and optionally auto‑merge, and adopt the CNCF reference architecture and the open source Fresca supply chain factory plus provenance, SBoM + VEX for exploitability, and Sigstone/Cosine signing to get verifiable artifacts and automation across pre‑build, build and post‑build.
AI-written summary · about
chapters (11)
- 0:00Supply chain security risks
- 3:52Supply chain attacks rising
- 7:52Cloud security challenges
- 12:27Shifting left limitations
- 15:56CNCF best practices
- 19:52Defining problem scope
- 23:46Supply Chain Factory steps
- 27:40Understanding software bill of materials limits
- 31:34Updating dependencies with Renovate
- 37:35Key takeaways
- 40:05Q&A
related talks
41mManaging the Risk of Software Supply Chain Attacks
41mSupply Chain Armoring: Tools and Techniques for Open Source Projects
44mKeeping Your Software Supply Chain Healthy
37mSupply Chain Attacks and the Future of Software Delivery
25mYour Software Supply Chain is Only as Secure as its Weakest Link
15mSupply chain security for dummies
36mBuilding a Trusted and Resilient Software Supply Chain
14mSupply Chain Security, why should I care?