Software Supply Chain: Panel on Threat Intel, Trends, Mitigation Strategies
summary
Panelists claim attackers shift upstream for big ROI — SolarWinds hits ~18,000 orgs, 3CX affects many customers — and urge treating a malicious package as a breach (rotate creds, assume compromise). Practical fixes: SLSA/SSDF attestations, VEX and osv.dev, automated SBOMs need continuous validation, and content checks not filename matches. Demonstrations include an Overlay browser extension that flags packages in dev flow, a 20‑company data‑sharing effort, and AI detection failures where comments fool classifiers.
AI-written summary · about
chapters (20)
- 0:00Introduction
- 1:07Defining supply chain security
- 6:12Incident response for attacks
- 8:42Vulnerable vs malicious code
- 9:48Trusting open source deps
- 11:14Why attacks are rising
- 13:27Collaboration against threats
- 15:37Security in R&D
- 18:04Tracking malicious packages
- 19:52Adapting AppSec to threats
- 23:36Developer awareness
- 25:23Integrating security workflows
- 27:12AI limits in detection
- 30:05AI impact on threats
- 31:57DHS SBOM requirements
- 37:13Missing standards for consumers
- 40:31Q&A on responsibility
- 42:02Reproducible SBOM challenges
- 44:13SBOM ingestion challenges
- 48:37Closing remarks
related talks
37mSupply Chain Attacks and the Future of Software Delivery
39mSoftware Supply Chain Security
29mSupply Chain Security: Threats, Defenses And What You Can Do
58mAttacking through the Software Supply Chain
25mSupply Chain Attacks
15mSoftware Supply Chain Security for those in a rush
51mThe Enemy Within: Modern Supply Chain Attacks
41mHow to protect your software project from supply chain security threats