"Choose Your Own Disaster – Rusty and the Crate Escape!"
summary
A live choose‑your‑own‑adventure tabletop simulates a supply‑chain incident where compromised CI and two fake GitHub identities push a malicious PR, Dependabot updates get merged en masse, and a zero‑day drops on Mastodon then hits Hacker News. Concrete takeaways: use SBOMs, vet contributor onboarding, call Cert‑CC/ENISA/OpenSSF for embargoed disclosure, and expect attackers to break out in 48 minutes (world record 51s), with breaches averaging ~$5M and ~260 days to recover.
AI-written summary · about
chapters (12)
- 0:00Introduction to exercise
- 1:33Incident response basics
- 2:42Why cybersecurity matters
- 4:30Case study and methodology
- 8:23Stages of incident handling
- 10:48Setting the scenario
- 14:00Inject 1: Suspicious PRs
- 18:03Inject 2: Dependency updates
- 22:08Inject 3: Zero-day disclosure
- 27:53Inject 4: Crisis management
- 32:31Principles of response
- 39:16Q&A and concluding thoughts
related talks
25mWhen the supply chain hits a sour note
32mBreaking the Chain: Advanced Offensive Strategies in Software Supply Chain
52mGitHub Actions Security: From CI Nightmare to Supply Chain Sentinel
36mPanel: It’s Not If, It’s When - Practical Preparation for the Next Software Supply Chain Attack
33mIn the Trenches During a Software Supply Chain Attack
46mApplication security from start to finish
45mChoose Your Own Adventure: Group Interactive IR Scenario
36mBuilding a Trusted and Resilient Software Supply Chain