Lessons Learned Building a Software Supply Chain Security Team

The speaker, who leads a supply chain security function at a cryptocurrency exchange, describes building that team from scratch over about a year. Coming from application security consulting, they found that supply chain security was discussed heavily at recent conferences but rarely with concrete guidance, and that few tools generated software bills of materials well. The team's scope was defined around open source dependencies, purchased software, supplier risk, and the security of the build and deploy pipeline.

The middle of the talk covers practical findings. Producing a complete SBOM across containers, virtual machines, many repositories and blockchain code proved hard, and many generated outputs failed format validation. Dependency scanners gave inconsistent results, with some Gradle setups silently reporting far fewer libraries than were present. During the Log4j response, locating affected code took days, while a later Apache Commons issue was assessed within an hour after combining scanner output, SBOMs and code search. Personal access tokens were called a major weakness, and suppliers largely did not provide SBOMs at all.

The closing lessons favour pragmatism: start with something small, write down a working definition, expect overlap with GRC and appsec teams, and fit into developers' existing workflows instead of forcing shift-left habits. Collect metrics before launching initiatives so progress can be shown over time. The speaker concludes that SBOMs are a starting point and a bare minimum rather than the end goal.