Many of the concepts discussed in software supply chain security come out of old fashioned material goods supply chains. "Chain" is a broken metaphor for security. The software supply "web" would be more appropriate. This session will present and debate alternative models developers should be using from other industries, which is a mix of standards, some testing, and some enforcement.


RSA® Conference, the world’s leading information security conferences and expositions, today concluded its 31st annual event at the Moscone Center in San Francisco. The year’s event attracted over 26,000 attendees, including 600+ speakers, 400+ exhibitors, and over 400 members of the media. Throughout the week, attendees networked on the expo floor and participated in keynote presentations, track sessions, tutorials, seminars, and special events.

Several of the most pressing topics discussed during this year’s Conference included issues surrounding privacy and surveillance, the positive and negative impacts of machine learning and artificial intelligence, the nuances of risk and policy, and cybersecurity-focused innovations across crypto and blockchain.

Is a Secure Software Supply Chain Even Possible, Let Alone Feasible?

Conference: RSA Conference 2022

Abstract

Post a comment

Related work

Google SLSA & NIST SSDF: Emerging Software Supply Chain Security Best Practices

Software supply chain safety: lessons from the industrial revolution

How Security, Development & Testing can work together to stop the same recurring vulnerabilities appearing in the OWASP Top 10

The Various Shades of Supply Chain: SBOM, N-Days and Zero Trust

Maslow's Hierarchy of Supply Chain Needs

Empowering the Guardians of Your Code Kingdom