The Road to Zero CVEs: People and Technology - Andrew Martin & Michael Lieberman
Open source software is critical to the digital landscape but remains vulnerable to supply chain attacks. This risk has drawn unparalleled scrutiny, and as international governments enact legislation focused on supply chain security, we developers and maintainers must decipher what these bodies mean by a "supply chain attack." We analyse the current state of supply chain security and legislation to illuminate a path forward, harmonizing legislative trends and cybersecurity advancements to fortify our open source ecosystems. We explore:
- Compromises inherent in supply chain resilience practices
- Emerging open source tooling to bolster our defences, like Sigstore, in-toto, and GUAC.
- CVEs management approaches to ensure production-safe environments
- Incrementally adopting new patterns and practices like SLSA and S2C2F
- Collaboratively enacting a more secure, resilient future for our supply chains
Related events & webinars
View allHack & Snack – Beer, Pizza & DevSecOps!
Hosted by DevSecCon & ControlPlane at the Snyk Office on October 24th
Is the Internet on Fire? Strategies for Mitigating Open Source Software Vulnerabilities - Andrew Martin, ControlPlane & Michael Lieberman, Kusari
Open source is deployed everywhere, but is no longer trusted by default. Supply chain attacks via package registries, GitHub, and various accidental and entirely understandable vulnerabilities have proven that nothing is entirely secure.
Invisible Infiltration of AI Supply Chains: Protective Measures from Adversarial Actors - Torin van den Bulk, ControlPlane
Malicious human and AI actors can infiltrate AI supply chains, compromising the integrity and reliability of the resultant AI systems through training data tampering, software or model backdoors, model interference, or new runtime attacks.
Speak to an expert
Engage with world-leading AI and cloud security specialists