Measure and Improve Software Supply Chain Assurance with OWASP SCVS
summary
Claims a practical standard that measures and raises software supply chain assurance by requiring concrete controls: software bill of materials (SBOMs) for accurate inventories, build‑environment hardening, mandatory use of package managers, component analysis including pedigree and provenance, and binary vs manifest analysis for discovery. Provides three levels of verification mapped to automation and regulatory needs (FDA SBOM mention), yields measurable, auditable controls, and notes tradeoffs in cost versus assurance and incremental adoption paths.
AI-written summary · about
chapters (12)
- 0:00Start
- 0:20Steve Springett
- 1:13Software Supply Chain Assurance for Critical Infrastructure
- 4:26Has Sca Improved Software Assurance
- 5:57Breaking Trust Shades of Crisis across an Insecure Software Supply Chain
- 7:01Third-Party and Open Source Dependencies
- 9:26Binary Analysis and Manifest Analysis
- 11:42Risk Hardening Build Environments
- 12:57Benefits of Using Package Managers
- 13:39Component Analysis
- 14:13Pedigree and Providence
- 16:39Are Scvs Control Requirements Measurable
related talks
08mKeynote: Approaching the SBOM: Best Practice for Software Supply Chain Security
23mSBOM adopatability in open source software scanning
32mSoftware Supply Chain Security
45mPractical Software Supply Chain Security Solutions
14mKeynote: The Next Steps in Software Supply Chain Security
39mSecure Your Supply Chain: Adding a Software Bill of Materials to Your Containers to Improve...
40mSoftware Supply Chain for the SDV Future — Logistics, Cybersecurity and Compliance
23mMastering Secure Software Supply Chains