E13: Software Supply Chain Security: All You Need To Know

Researchers found a 633% year-over-year increase in software supply chain attacks in 2022 so far, and there has been an annual, overall increase of 742% since 2019.

In this Episode, Barak Brudo (Developer Relations Advocate at Scribe Security) and I have discussed some of the finer points of Software Supply Chain Security, from what it is to what you can do today to make your company’s code much more secure (hint, use an SBOM).

Episode timelines

00:54 All about our guest

01:40 What does Software Supply Chain even mean?

08:44 Diving into the Security aspect of Software Supply Chain

13:24 Where did the name SBOM came from?

16:14 How does SBOM reports looks like actually?

18:51 Talking more about what's SBOM is...

22:32 Is having an SBOM mean you are totally secured?

32:43 What are the shortcomings of using an SBOM?

33:18 Summary & Closing

Resources:

The open-source SBOM: https://github.com/tern-tools/tern

An open-source tool that allows scanning an SBOM for CVEs: https://github.com/anchore/grype