SupplyChainSecurityCon North America 2021
2021-10-11
-- online --
[SupplyChainSecurityCon at Open Source Summit North America 2022, SupplyChainSecurityCon at Open Source Summit Europe 2022, SupplyChainSecurityCon @ Open Source Summit North America 2024, SupplyChainSecurityCon @ OSS NA 2023, SupplyChainSecurityCon @ Open Source Summit Europe 2023, Open Source SecurityCon Europe 2026]
| title | author | length |
|---|---|---|
| Welcome and Kickoff! | Dan Lorenc | 09m |
Event opens with logistics: mask policy, virtual moderator Kim relays chat questions, snack and lunch locations, and a mix of live and pre-recorded talks… | ||
| Keynote: Approaching the SBOM: Best Practice for Software Supply Chain Security | Daniel Nurmi | 08m |
Survey of large enterprises finds most report a software supply chain incident and about 60% of respondents plan focused supply-chain work in the next 12… | ||
| Keynote: Software Supply Chains for Devops | Aysylu Greenberg | 09m |
Cloud-focused checklist for reducing mean-time-to-detection and understanding: captures which artifacts, checks and timestamps are needed so rollback and… | ||
| Keynote: Project Trebuchet: How SolarWinds is Using Open Source to Secure Their Supp... | Trevor Rosen | 37m |
Sunburst compromises Orion via a malicious DLL and stays inside for about 18 months, impacting fewer than 100 customers. The response rebuilds CI/CD as Project… | ||
| Keynote: Security of the Open Source Supply Chain, a Call to Action | Luke Hinds | 08m |
Argues that supply chain security is urgent and actionable, citing Kubernetes’ dependency matrix at 513 and React Native yarn files with 7,109 lines to show… | ||
| The State of SBOMs | Dan Lorenc, Allan Friedman, Nisha Kumar, Frederick Kautz | 38m |
Cloud-native projects now produce SBOMs at build time and Kubernetes ships SBOMs in a recent release, using standards like CycloneDX and SPDX and tools such as… | ||
| Whose Sign Is It Anyway? | Marina Moore, Matthew Riley | 17m |
A valid signature only proves a private key and data coexisted once; meaning comes from policy that maps keys to identities, decides key storage, and defines… | ||
| Supply Chain Security with the Jenkins Templating Engine! | Steven Terrana | 30m |
Explains replacing per-repo Jenkinsfiles with a central Jenkins Templating Engine template plus plug‑in libraries so teams pick Maven or Gradle while the org… | ||
| 5G and Challenges with Software Supply Chain Security | Fatih Degirmenci | 14m |
5G networks move from proprietary appliances to cloud native VNFs and CNFs deployed in public, private and edge clouds, creating a multi-vendor, multi-source… | ||
| PyPI Supply Chain Security | Dustin Ingram | 10m |
The Python Package Index runs mostly on volunteers and serves more than 2 billion requests/day with an estimated cost of $2.3M/month to operate; recent… | ||
| An Overview on SLSA | Tom Hennen, Joshua Lock | 15m |
SLSA defines four numbered levels (1–4) with concrete requirements: level 1 produces unsigned provenance; level 2 moves checks into the build service; level 3… | ||
| State of the Art Supply Chain Security | Trishank Karthik Kuppusamy, Asra Ali, Santiago Torres-Arias | 32m |
Claim: a transparent, compromise‑resilient supply chain is practical today. Implementation stitches in-toto, TUF, and SigStore (cosign/fulcio/rekor) into CI/CD… | ||
| Finding Your Way: A Survey of Supply Chains | Aeva Black | 15m |
A lightweight map of the open source supply chain landscape that lists 12 foundations and roughly 42 projects and groups tools into five concrete categories… | ||
| Vulnerability Supply Chains | Art Manion | 11m |
Coordinated disclosure and vulnerability management remain manual and guess-driven since 2002 despite incidents like BadAlloc and KRACK; investigations still… | ||
| Cloud Native Supply Chain Security with Tekton and Sigstore | Priya Wadhwa, Christie Wilson | 22m |
A Tekton Task runs Kaniko to build and push an image and writes results (image URL and digest); Tekton Chains watches the TaskRun, extracts those results, uses… | ||
| Getting Started with Supply Chain Security is Easier Than You... | Michael Lieberman, Timothy Miller | 20m |
Claims that getting started is practical: a demo builds a Rust Hello World with Kaniko, emits a CycloneDX SBOM, attaches Cosign signatures and Tekton Chains… | ||
| Closing Remarks | 01m | |
Event wrap-up thanks attendees and crew, notes a few virtual hiccups that organizers work around, and points out that host Dan leaves to record a Cloud Native… | ||
| nothing matches | ||