Challenge Accepted: 3 Experts, 3 Big Ideas on Supply Chain Security
summary
Shows how to make device supply chains auditable end to end: adopt DeviceSecOps with SCA, SAST, DAST, manual pentest and Site Acceptance Tests for final units; track that >80% third‑party code with SBOMs and Hardware BOMs; feed results into a risk repository so procurement can demand evidence and asset owners can run targeted verification. Covers practical formats (SPDX/CycloneDX/SWID), the minimum SBOM (component supplier version hash provenance) and VEX/CSAF for “we’re not affected” notices, plus sector pilots in healthcare, automotive and energy.
AI-written summary · about
chapters (7)
related talks
37mSecuring OSS across the whole supply chain and beyond
18mA Different Kind of S3: First Line Security of the Supply Chain
39mSoftware Supply Chain Security
54mSecuring the Digital Supply Chain: What we should do for Supply Chain Security in DevSecOps?
15mSupply chain security for dummies
23mMastering Secure Software Supply Chains
18mA Different Kind of S3: First Line Security of the Supply Chain
41mSupply Chain Armoring: Tools and Techniques for Open Source Projects