OSS Supply Chain Threats and Why You Need a Holistic Security Strategy
summary
Open source dependencies show 98% prevalence and Microsoft finds 83,000 unique packages used 11 million times; attacks doubled in 2023 and exploit published CVEs within three days, so set a North star: update dependencies within three days. Real incidents include left-pad removal, dependency confusion, typo‑squatting, es‑lint and event‑stream credential exfiltration, UA‑parser npm account compromise, and build‑time attacks like SolarWinds. Adopt S2C2F: eight practices, maturity levels 1–4, automation like Dependabot and GitHub Actions, artifact caching and rebuild critical packages for highest-risk software.
AI-written summary · about
chapters (13)
- 0:00OSS supply chain threats
- 6:46Real-world incidents overview
- 16:51Malicious package attacks
- 23:26Maintainer sabotage risks
- 27:45Security requirements from incidents
- 29:13Secure Supply Chain Consumption Framework
- 32:45S2C2F eight practices
- 34:34OSS security maturity model
- 37:26Future goals and collaboration
- 42:05Adoption barriers and tooling
- 46:21Microsoft’s maturity roadmap
- 47:53Standardization and attestation
- 50:30Q&A
related talks
41mManaging the Risk of Software Supply Chain Attacks
07mHow to Secure Your End-to-end Supply Chain
44mKeeping Your Software Supply Chain Healthy
42mHacking the OSS Supply Chain
11mSupply Chain Cybersecurity
29mSecuring the Unseen: Defending Against Open Source Software Supply Chain Attacks
39mOpen Source Software Supply Chain Security — Why does it matter?
37mSupply Chain Attacks and the Future of Software Delivery