Practical Software Supply Chain Security Solutions
summary
Claims that SBOMs and SCA snapshots are necessary but insufficient and show why with examples: dependency confusion, repo jacking, typo squatting and repo poisoning each allow malware to slip past package managers; npm and Docker Hub are singled out and XZ utils is given as a near-disaster. Practical defenses include reserving package names, pinning versions, validate checksums, use scoped packages, enforce two‑factor auth, and run runtime analysis (DeepFactor style) plus reproducible builds to prove what was actually shipped.
AI-written summary · about
chapters (11)
- 0:00Software supply chain security intro
- 3:57Supply chain attacks explained
- 10:31Regulations impact
- 19:32Trust but verify
- 22:04Dependency dangers
- 27:00Dependency confusion
- 31:42XZ Utils backdoor
- 35:00Repo jacking threats
- 39:59Why SBOMs aren’t enough alone
- 41:23Reproducible builds
- 43:12Security tool gaps
related talks
22mSofware Supply Chain Security Is Hard. But Does it Need to Be?
15mSupply chain security for dummies
01h 02mProtect Yourself Against Supply Chain Attacks
37mSupply Chain Attacks and the Future of Software Delivery
38mSecuring the chains: Building defensive layers for software supply chains
41mManaging the Risk of Software Supply Chain Attacks
40mSoftware Supply Chain Aspects in Infrastructure as Code, and How to Secure it
43mOur Dependence on Open Source Is Scary. SLSA, SBOM and Sigstore to the Rescue