Keynote: Approaching the SBOM: Best Practice for Software Supply Chain Security
summary
Survey of large enterprises finds most report a software supply chain incident and about 60% of respondents plan focused supply-chain work in the next 12 months. Practical claim: generate SBOMs with tooling like Syft and standards such as SPDX, In-Toto, SigStore and extend manifests with file checksums, embedded configs and provenance so CI can record an intended SBOM, produce an observed SBOM, and detect surprising drift between them to catch injected code or leaked credentials.
AI-written summary · about
chapters (5)
- 0:00Supply chain security survey
- 2:08Understanding supply chains
- 3:49Role of SBOMs
- 5:57Future of SBOM usage
- 8:03Conclusion
related talks
14mKeynote: The Next Steps in Software Supply Chain Security
16mKeynote: SBOM is Coming: Why You Should Care and How You Can Help
12mKeynote: DevSecOps and the Art of Not Ending Up On the Front Page
29mMaking Software Bill of Materials (SBOMs) Actionable
30mTransparency in the Software Supply Chain: Making SBOM a Reality
37mSBOMs Aren't Enough. Secure Your Software Supply Chain End-To-End
12mKeynote: A Vision for a Secure Software Supply Chain
35mSBOMs: Navigating the Evolving Landscape of Software Bill of Materials