Exploring a Risk Approach to Software Supply Chain Security
summary
Software supply chain attacks act as the initial step in broader attack chains, so adopt a practical risk model that scores data risk, external risk, software risk, and license risk and drives deployment decisions. Require provenance metadata and rebuild evidence for packages, route installs through proxy registries and CI (eg CircleCI), sandbox packages before integration, and run continuous monitoring, logging and traceability across ingestion, inventorying, build, registry and execution to enable targeted controls and remediation.
AI-written summary · about
chapters (10)
- 0:00Introduction and agenda
- 1:03What is software supply chain
- 2:26External supply chain threats
- 3:29Internal supply chain threats
- 4:55Software supply chain attacks
- 5:57Risk-based deployment model
- 8:28Areas of opportunity
- 12:19Goal of risk-based controls
- 13:41Recap and key takeaways
- 14:45Q&A session
related talks
41mManaging the Risk of Software Supply Chain Attacks
29mSupply Chain Security in the Software Era
44mKeeping Your Software Supply Chain Healthy
37mSupply Chain Attacks and the Future of Software Delivery
41mSupply Chain Armoring: Tools and Techniques for Open Source Projects
22mSofware Supply Chain Security Is Hard. But Does it Need to Be?
38mSupply Chain Security & the Real World: Lessons From Incidents
07mHow to Secure Your End-to-end Supply Chain