Software Supply Chain Security for those in a rush
summary
Supply-chain attacks exploit shared dependencies: SolarWinds leads to the Colonial Pipeline outage, a CA patch causes Coop to close ~700 stores for 24 hours with a backdoor leaking customer data for two months, and CircleCI exposed AWS keys for two weeks; researchers find ~800 leaked secrets on GitHub. Defenses are concrete: publish an SBOM (SPDX or CycloneDX), adopt SLSA level 3 rules (signed commits, 8‑month history, scripted builds), and sign artifacts with tools like cosign and log attestations to rekor for verifiable provenance.
AI-written summary · about
chapters (9)
- 0:00Introduction
- 0:47Software supply chain attacks rise
- 3:35Modern builds and vulnerabilities
- 5:20Common attack vectors
- 7:07Frameworks for security
- 10:38Sigstore and SLSA trust
- 12:46SBOMs and importance
- 14:09Incremental security practices
- 14:30EU SBOM regulations
related talks
39mSoftware Supply Chain Security
39mOpen Source Software Supply Chain Security — Why does it matter?
37mSupply Chain Attacks and the Future of Software Delivery
29mState of the secure software supply chain
15mSupply chain security for dummies
22mSofware Supply Chain Security Is Hard. But Does it Need to Be?
19mKeynote: Supply Chain Security in 2024
25mSupply Chain Attacks