What Hacking the Planet Taught Us About Defending Supply Chain Attacks
summary
If you want actionable defenses, this shows a repeatable product security testing method that maps dependencies, runs basic enumeration and targeted reverse engineering, then produces prioritized, organization‑specific mitigations. Examples include an infusion pump flaw traced to a DBUS JSON library format‑string, the Codecov curl | bash uploader abuse, and Click Studios’ malicious update DLL; guidance covers SBOMs, PingCastle, Zeek/netflow, Jupyter automation and using StrideGPT for threat models so you can decide where to start.
AI-written summary · about
chapters (13)
- 0:00Introduction and speakers
- 1:27Defining supply chain attacks
- 3:14Hacking lessons learned
- 6:55Thinking red, acting blue
- 11:42Customizing security models
- 15:01Product security methodology
- 27:27Applying security tests
- 29:47Reviewing external code
- 32:21Securing update mechanisms
- 33:55Prioritization strategies
- 36:35Practical tools and tips
- 41:29AI for threat modeling
- 42:51Conclusion and Q&A
related talks
25mSupply Chain Attacks
15mSoftware Supply Chain Security for those in a rush
39mSoftware Supply Chain Security
33mIn the Trenches During a Software Supply Chain Attack
37mSupply Chain Attacks and the Future of Software Delivery
46mInsane in the Supply Chain: Threat modeling for...
46mApplication security from start to finish
35mSupply Chain Attacks: The New Reality