Adrian Mouat

Supply Chain Security and the Real World: Lessons From Incidents

One leaked secret in a Docker image compromised thousands of CI/CD pipelines. This talk dissects real-world breaches to show you how to truly secure your supply chain.

Supply Chain Security and the Real World: Lessons From Incidents
#1about 6 minutes

Moving beyond abstract security metaphors and vague advice

Security advice often relies on unhelpful abstractions, but real-world incidents provide concrete, actionable guidance for developers.

#2about 3 minutes

Analyzing the Codecov breach and its attack vector

The Codecov breach occurred when a secret in a Docker image led to a modified script that exfiltrated CI/CD environment variables.

#3about 5 minutes

Securing Docker builds and verifying script downloads

Prevent secret leaks in Dockerfiles by using the `--secret` flag and always verify downloaded scripts with checksums or GPG signatures.

#4about 2 minutes

The risks of storing secrets in environment variables

Storing secrets in environment variables makes them easy to exfiltrate, so prefer identity federation, secret managers, or temporary files instead.

#5about 5 minutes

Deconstructing the `changed-files` GitHub Action attack

A compromised dependency (`reviewdog`) was used to inject malicious code into the `changed-files` action, targeting Coinbase in a multi-stage attack.

#6about 2 minutes

Hardening GitHub repositories and pinning dependencies

Mitigate attacks by enforcing commit signing, restricting tag updates, and pinning GitHub Actions to a specific content digest.

#7about 2 minutes

Replacing long-lived credentials with short-lived tokens

Eliminate a common attack vector by replacing long-lived credentials with short-lived tokens generated via identity federation like OIDC.

#8about 1 minute

Summary of actionable supply chain security advice

A final recap covers key actions like verifying downloads, avoiding secrets in environment variables, pinning actions, and using short-lived credentials.

Related jobs
Jobs that call for the skills explored in this talk.

Matching moments

Understanding the rising threat to software supply chains
01:00 MIN

Understanding the rising threat to software supply chains

Open Source Secure Software Supply Chain in action

Key takeaways and next steps for securing your supply chain
25:54 MIN

Key takeaways and next steps for securing your supply chain

Securing your application software supply-chain

Exploring the core domains of supply chain security
02:46 MIN

Exploring the core domains of supply chain security

Open Source Secure Software Supply Chain in action

Learning from the SolarWinds supply chain attack
04:05 MIN

Learning from the SolarWinds supply chain attack

Securing your application software supply-chain

Implementing and enforcing supply chain policies
23:29 MIN

Implementing and enforcing supply chain policies

Securing your application software supply-chain

Why Dockerfile security is a critical foundation
06:06 MIN

Why Dockerfile security is a critical foundation

A practical guide to writing secure Dockerfiles

Preventing leaked secrets and managing dependencies
08:33 MIN

Preventing leaked secrets and managing dependencies

How GitHub secures open source

Defining key standards and terminology in supply chain security
09:08 MIN

Defining key standards and terminology in supply chain security

Open Source Secure Software Supply Chain in action

Featured Partners

Related Videos

See all videos
Real-World Security for Busy Developers29:50

Real-World Security for Busy Developers

Kevin Lewis

Securing your application software supply-chain28:27

Securing your application software supply-chain

Niels Tanis

Open Source Secure Software Supply Chain in action32:55

Open Source Secure Software Supply Chain in action

Natale Vinto

How GitHub secures open source25:28

How GitHub secures open source

Joseph Katsioloudes

How your .NET software supply chain is open to attack : and how to fix it28:45

How your .NET software supply chain is open to attack : and how to fix it

Andrei Epure

Simple Steps to Kill DevSec without Giving Up on Security21:53

Simple Steps to Kill DevSec without Giving Up on Security

Isaac Evans

Security Pitfalls for Software Engineers27:32

Security Pitfalls for Software Engineers

Jasmin Azemović

Walking into the era of Supply Chain Risks37:36

Walking into the era of Supply Chain Risks

Vandana Verma

From learning to earning

Jobs that call for the skills explored in this talk.