Supplier Risk Where OSS Collides With Vendor Management
summary
Argues that supplier risk outgrows simple SCA and moves to measurable supplier behavior: regulators demand software bill of materials, SPDX and CycloneDX emerge, and an OWASP verification standard targets provenance. Continuous monitoring clocks time to remediation for components—observed ranges run from hours to nearly a year—so suppliers get scores. Examples include FDA SBOM guidance, CMMC and NIST controls, contractual SLAs (seven‑day fixes) and automated monitoring that actually measures whether updates ship and how quickly.
AI-written summary · about
chapters (15)
- 0:00Introduction
- 4:20Open Source
- 5:45Threat Landscape
- 8:07Regulatory Mandates
- 11:33Supplier Ecosystems
- 13:31Con annuity
- 17:26Maintenance
- 20:18Simple Sabotage Manual
- 21:38Risk Differentiation
- 23:30Maintenance Records
- 26:22How Does This Affect OSS
- 30:48Concentration Risk
- 32:55Transparency
- 34:43Youre on the menu
- 35:49References
related talks
40mManaging Risk Across the Vulnerability Ecosystem
11mOSS Supply Chain Security
14mKeynote: The Next Steps in Software Supply Chain Security
37mSecuring OSS across the whole supply chain and beyond
41mManaging the Risk of Software Supply Chain Attacks
35mEffective Handling of Third-Party Supplier Incidents
11mSupply Chain Cybersecurity
31mThe Value of OSS Management for Risk Mitigation