Supply Chain Threats Deserve Their Own Incident Response Plan
summary
Most organizations lack a supply‑chain–specific incident response plan and standard playbooks, so the claim is that supply chain breaches require their own IR. Evidence: SBOM generators like CycloneDX miss context (file‑name conventions, ownership, annotations) and npm policies let malicious or rogue packages be unpublished, hampering forensics. Actionable tools and steps include constructing build timelines, rotating compromised CI and developer keys, checking CI logs and artifacts, and using digital forensics; breaches are not fixed by simply updating dependencies.
AI-written summary · about
chapters (17)
- 0:00Introduction
- 1:47Meet speaker
- 2:56Supply chain IR plan
- 4:44App vs IT security gap
- 10:30Challenges with Software Bill of Materials
- 13:03Key SBOM incidents
- 20:01SBOMs missing context
- 27:15Attacker view on threats
- 34:05Malicious vs vulnerable packages
- 37:20Malicious package types
- 42:44Why breaches can't be fixed by updates alone
- 44:32Triage steps
- 48:11Deleted package challenges
- 50:17Supply chain attack traits
- 52:25Future attack vectors
- 53:07AI in supply chain security
- 55:24Q&A
related talks
38mSupply Chain Security & the Real World: Lessons From Incidents
37mSupply Chain Attacks and the Future of Software Delivery
15mSupply chain security for dummies
35mSupply Chain Attacks: The New Reality
39mSoftware Supply Chain Security
15mSoftware Supply Chain Security for those in a rush
25mSupply Chain Attacks
50mThe World in Crisis: Prepare for Extreme Events via Supply Chain Resilience