Software supply chain security
18 moments from 16 videos · 55:34 min total
Securing software pipelines is critical to modern development. This playlist brings together essential moments from expert talks on managing open-source dependencies and verifying third-party packages.
Understanding software supply chain threats and security risks
The software supply chain encompasses all build tools and dependencies, which are increasingly targeted by data exfiltration attacks.
Essential best practices for securing nuget package configurations
Engineering teams prevent supply chain attacks by reserving package prefixes, signing binaries, clearing system defaults, and inspecting new targets.
Securing contextual storage and proving verifiable transparency
User-controlled encryption keys secure stored documents while hardware vendor attestation enables independent software assurance verification.
Mapping the complete software supply chain attack surface
Why comprehensive security requires validating build environments and commercial dependencies beyond open source component scanning.
Integrating security across the application development lifecycle
Adopting a progressive approach to threat modeling supply chains ensures that security practices scale with complex modern workflows.
Adopting the SLSA framework for supply chain maturity
Progressively implementing supply chain levels enables teams to automate verifiable provenance without manually juggling cryptographic keys.
Mitigating risks from supply chain attacks and vulnerable libraries
Exploited open source dependencies like Log4j highlight the absolute necessity for aggressive software supply chain oversight.
Implementing preventative cybersecurity to mitigate software supply chain risks
Teams must actively prioritize access control and foundational security checks instead of relying on delayed patching protocols.
Gaining software supply chain visibility through upstream engagement
Participating directly in upstream development eliminates vendor bottlenecks and secures control over essential infrastructure dependencies.
Artificial intelligence components in the software supply chain
Integrating language models introduces inherited vulnerabilities into development workflows regardless of direct implementation.
Evaluating supply chain risk through automated dependency reviews
Checking new package manifests against global advisory databases during branch merges prevents the introduction of critical software supply chain vulnerabilities.
Securing digital supply chains using isolated build environments
Generating provenance proofs natively inside secure hardware guarantees the integrity of continuous software bills of materials.
Avoiding supply chain risks within standard software dependencies
Recognizing hidden threats located inside widely adopted package managers and binary compilation tools.
Vulnerabilities within the cyber software supply chain
Why relying on open-source software packages like Log4J exposes enterprises to long-tail security patching risks.
The security trade-offs of auto-updating software dependencies
Distributing untethered updates through CDNs or automated package managers can rapidly propagate supply chain attacks to end users.
Migrating to a software-centric component supply chain
Vehicle manufacturers are securing control over system updates by converging separate component functionalities against generic underlying modules.
Securing hardware enrollment via FDO specification and signing
Adopting automated zero-touch provisioning and system image signing protects the broader software supply chain from rogue devices.
Practical mitigation strategies for modern software supply chains
Rebuilding immutable containers, migrating to memory-safe languages, and adopting zero-trust practices minimize the attack surface.
Your mix. Instantly.
More mixes
AI & Machine Learning
AI coding agents
AI & Machine Learning
MCP (Model Context Protocol)
AI & Machine Learning
RAG
Languages & Frameworks
TypeScript
Languages & Frameworks
React
Languages & Frameworks
Java
Cloud, Platform & Data
Platform engineering
Cloud, Platform & Data
Observability
Cloud, Platform & Data
Infrastructure as code
Architecture, Quality & Security
System architecture
Architecture, Quality & Security
Code review
Architecture, Quality & Security
Software supply chain security
Leadership, Career & Community
Engineering strategy
Leadership, Career & Community
Developer experience
Leadership, Career & Community