Keynote: Project Trebuchet: How SolarWinds is Using Open Source to Secure Their Supp...
summary
Sunburst compromises Orion via a malicious DLL and stays inside for about 18 months, impacting fewer than 100 customers. The response rebuilds CI/CD as Project Trebuchet: a GitHub app fetches pipeline YAMLs and triggers Tekton + Tekton Chains which emit in-toto attestations signed via sigstore/AWS KMS into a document DB; a parallel two parallel clusters architecture (standard + isolated validation) runs identical builds from different inputs for consensus. Tooling includes JFrog Xray, OPA policies, ephemeral EC2 AMIs for non-container builds, and ongoing red teaming.
AI-written summary · about
chapters (14)
- 0:00Intro
- 2:44What is a Supply Chain Attack
- 8:29Project Trebuchet
- 11:38The Golden Rule
- 12:59Why it wont work
- 14:31Trebuchet Dev Experience
- 15:28Trebuchet GitHub
- 18:45Provenance
- 19:34InToto
- 23:08Consensus
- 23:33Validation Cluster
- 27:41Vulnerability Analysis
- 29:35Conclusion
- 32:02Questions
related talks
11mKeynote: Securing Open Source
12mKeynote: DevSecOps and the Art of Not Ending Up On the Front Page
54mSupply Chain Security for OpenSource Projects
12mAs Strong As the Weakest Link: Securing the Software Supply Chain
29mState of the secure software supply chain
39mReflections on Trust in the Software Supply Chain
15mKeynote: Improving OSS Security Through Collaboration
23mSolarWinds: What Really Happened?