Is the Internet on Fire? Strategies for Mitigating Open Source Software Vulnerabilities - Andrew Martin, ControlPlane & Michael Lieberman, Kusari
Open source is deployed everywhere, but is no longer trusted by default. Supply chain attacks via package registries, GitHub, and various accidental and entirely understandable vulnerabilities have proven that nothing is entirely secure. What tools do we have at our disposal to defend ourselves? From examining SBOMs and source code, open source ingestion techniques and signing, to assured open source programs, traditional defence in depth measures, and the emerging next generation of security controls — this talk examines the open source security landscape and the tools, patterns, and practices we have available to defend ourselves. We dive deep into:
- The safety and sanctity of open source software ingested from GitHub and package managers
- The value of SBOMs and assured software throughout the build, ingestion, and runtime phases
- Incident response with open source security tools
- Designing systems beyond zero trust for compromise resilience and assumed breach
Related events & webinars
View allInSPIREing Progress: How We're Growing SPIFFE & SPIRE in 2023 & Beyond- Daniel Feldman & Andrés Vega
SPIFFE/SPIRE keeps your data safe and hackers away by automatically assigning unique, secure credentials based on the unique properties of your software. It's a bit like a fingerprint scanner, but for code.
Kubernetes Supply Chain Security: The Software Factory - Andrew Martin, Control Plane
The original supply chain attack was described by Ken Thompson 35 years ago, in Reflections on Trusting Trust.
The State of Your Supply Chain - Andrew Martin, ControlPlane & Maya Kaczorowski, Google
Container security often focuses on runtime best-practices whilst neglecting the software shipped in the supply chain.
Speak to an expert
Engage with world-leading AI and cloud security specialists