Navigating a Mined World: Repositories, Registries and Artifact Storages.
summary
Shows concrete risk metrics and fixes: Log4Shell lives in 70,000 direct and 174,000 transitive Java projects, Equifax cleanup tops $1.4B and average breach cost hits $4.45M (2023). Demonstrates a Spring microservice with 114 dependencies seven layers deep, cites PyTorch nightly compromise lasting five days and left-pad removing 272 packages. Recommends controlling artifacts with a repository/artifact manager, proxying internal packages, regular vulnerability scanning, building releases once and promoting them, and pulling base images from private registries.
AI-written summary · about
chapters (12)
- 0:00Introduction and speaker background
- 3:19Security awareness for developers
- 7:54Types of software attacks
- 13:08Developer workflow and dependencies
- 17:29Understanding vulnerabilities
- 19:58Malicious packages and attacks
- 23:30Public repo risks and left pad incident
- 24:56Container and image security
- 26:20Regulation and tools for security
- 27:23Managing project dependencies
- 28:27Permissions and maintenance
- 30:14CI/CD process optimization
related talks
55mCI Pulled It, Prod Ran It: The Real Risk in Dependency, by GraphsIlkka Turunen
08mAll About Dependencies
11mIdentifying Security Vulnerabilities at Scale: Venture Inside a Pipeline
21mWhy Building Your Ship (Application) with Raw Materials is a Bad Idea!
41mThe Divine and Felonious Nature of Cyber Security
26mKnow Your Dependencies: A Guide to Automating Dependency Assurance
36mBuilding a Trusted and Resilient Software Supply Chain
32mGuardians of the Cloud Navigating the Depths of Cloud Threat Hunting