When dependabot is not enough, protecting our software supply chain -Edoardo Dusi
See how dependency scanning and update tools can help developers manage risks across a software supply chain.
Summary
The speaker explains software supply chain risks, using pizza ingredients as an analogy for dependencies and the steps involved in building and distributing software. The talk covers how dependency vulnerabilities can enter a project and describes Dependabot, vulnerability databases, and other scanning and update tools. Attendees learn what to look for in vulnerability management tools and ways to take part in open source security discussions.
Related talks
The Linux Foundation·37 min
Yongjae Chung · Justin Cappos
Evaluates SBOMs Arent Enough. Secure Your Software Supply Chain End-To-End and evaluates key implications for security practitioners.
Black Hat·53 min
Analysts investigate attack surfaces and defenses concerning TLBleed: When Protecting Your CPU Caches is Not Enough.
Videos·31 min
Industry experts analyze emerging threats surrounding 5 Ways to Mitigate Costly Software Supply Chain Attacks to Get Your SDLC in Check.