Managing the Risk of Software Supply Chain Attacks
summary
Ninety percent of companies rely on open source and supply-chain compromises grow explosively (uploader cites a 742% annual rise), so focus on concrete controls: run npm audit and OSS dependency scanners and static analyzers like semgrep or SonarQube, build and validate SBOMs and approve SBOMs for elevated‑priv apps, patch and redeploy immutable instances regularly with file‑integrity and endpoint detection, enforce MFA, and lock down CI/CD pipelines and repo permissions to stop tainted updates and malicious packages.
AI-written summary · about
chapters (16)
- 0:00Introduction
- 1:01Rising threat of supply chain attacks
- 3:34Defining software supply chain
- 7:46Vulnerabilities in own code
- 9:36Third-party library risks
- 13:34Software bill of materials
- 15:47Test code attack surface
- 18:15Production infrastructure risks
- 21:04Securing CI/CD pipelines
- 25:40Code repository vulnerabilities
- 28:05Securing dev/admin laptops
- 31:21Vendor security assessments
- 34:35Browser plugin risks
- 37:08Insider threats
- 39:43Cloud account hijacking
- 40:26Summary
related talks
07mHow to Secure Your End-to-end Supply Chain
44mKeeping Your Software Supply Chain Healthy
51mOSS Supply Chain Threats and Why You Need a Holistic Security Strategy
37mSupply Chain Attacks and the Future of Software Delivery
39mOpen Source Software Supply Chain Security — Why does it matter?
49mMitigate Risks In Code: Protect Your Software based Supply Chain
29mSecuring the Unseen: Defending Against Open Source Software Supply Chain Attacks
11mSupply Chain Cybersecurity