Effective Software Supply Chain Monitoring
summary
Describes a DIY monitoring pipeline that identifies installed components by hashing and metadata, matches them to CVEs via a local relational database, and runs daily updates — author uses OWASP Dependency Checker and the NIST Software Reference Library for lookups. The prototype stores product→component→CVE relationships, surfaces new products and 20–30 daily CVEs, and provides triage states (Relevant, Not Relevant, Under Investigation). Built internal UI with debugging views and it successfully flags issues like 324 OpenSSL CVEs across embedded products.
AI-written summary · about
chapters (17)
- 0:00Intro
- 2:08The Problem - Corporate Consumption...
- 3:47Problem #1?
- 4:50Manual Product Analysis
- 7:10The Real Component Issue
- 8:09Components in Products
- 9:21Product Component Declarations
- 11:46Elements of a Solution
- 13:09Relationships
- 14:43Procedurally
- 16:42Update the CVE List
- 18:09Thoughts
- 21:01Next Step: Build a Proof of Concept
- 22:45Caution
- 24:07Issues....
- 24:29Re-Cap Applying This Today
- 25:17Remember
related talks
27mSecuring the Software Supply Chain: Integrating OpenSSF Scorecard, Jenkins, and the O...
46mSafely through the dependency minefield using OWASP Dependency Track
31mEfficient Vulnerability Management in Hierarchical Supply Chains
34mDependency Track
52mBuilding Community-Driven Security Analysis for Your .NET Software Supply Chain
24mDependency Track Fortifying The Supply Chain
54mSupply Chain Sec /w Dependency Track
41mSupply Chain Armoring: Tools and Techniques for Open Source Projects