Google SLSA & NIST SSDF: Emerging Software Supply Chain Security Best Practices
summary
Compares NIST SSDF v1.1 (what minimum security controls to require) with SLSA levels 0–4 (how to score and harden build systems), recommends concrete steps: generate authenticated provenance and SBOMs, enforce MFA and two-person review, require hermetic builds and code signing, retain source/build logs (18 months minimum for higher levels), run static/dynamic analysis and fuzzers, and scan for hard‑coded secrets; cites a striking metric: 60% of breaches caused by unpatched dependencies.
AI-written summary · about
chapters (17)
- 0:00Start
- 1:42Software Supply Chain Attacks are on the Rise
- 2:47Presidential Executive Order
- 4:19Software Supply Chain Security
- 4:51Cybersecurity Labeling for Consumers
- 6:02Risk Severity Schema
- 6:27Recommended Minimum Standard for Vendor or Developer Verification of Code
- 6:56Key Practices
- 7:37Google's SLSA framework
- 12:46Provenance Content
- 13:44Common
- 15:02Complementary Frameworks
- 16:55Review for Hard-Coded Secrets
- 17:22Security Policy
- 18:41Tampering Risk
- 19:28Identify Suspicious Behavior and Code Leaks
- 20:02Slow each layer of protection
related talks
20mAnalyzing Google’s SLSA Framework for Securing Software Supply Chains
16mSecuring the Modern Software Supply Chain: A Beginner’s Guide To SLSA, SBOM, and Beyond
34mFrom development to release: Protecting the software supply chain
59mIntroduction to SLSA
43mSLSA, SigStore, SBOM & Software Supply Chain Security. What does it all mean?
11mContinuous Assurance of Supply Chain Security Levels of Open Source Artifacts using SLSA 0.1
14mSLSA - A supply chain security framework
22mSofware Supply Chain Security Is Hard. But Does it Need to Be?