Supply Chain Security: Threats, Defenses And What You Can Do
summary
Describes how the SolarWinds 2020 compromise propagates via malicious package uploads and cites FBI reporting ~300% rise in attacks, then shows practical defenses Red Hat uses: SBOM generation and artifact provenance with cryptographic hashes, a central artifact factory and isolated build service, SCA SAST DAST and fuzzing scans, secure base images (Clear recommended), gated CI/CD, versioned source repos and enforced separation of duties. Empirical claim: these measures reduce injection and propagation risk across multi‑cloud, multi‑tool pipelines.
AI-written summary · about
chapters (10)
- 0:00Supply chain security intro
- 1:05Why security is critical now
- 3:57Software supply chain overview
- 8:55Common pipeline threats
- 10:19Third-party library risks
- 11:22Dev security recommendations
- 14:38Artifact provenance & integrity
- 16:44Secure supply chain frameworks
- 18:30Security vs development culture
- 21:46Q&A
related talks
37mSupply Chain Attacks and the Future of Software Delivery
39mSoftware Supply Chain Security
41mSupply Chain Armoring: Tools and Techniques for Open Source Projects
54mSupply Chain Security for OpenSource Projects
25mSupply Chain Attacks
15mSupply chain security for dummies
15mSoftware Supply Chain Security for those in a rush
29mState of the secure software supply chain