Duration: 0:00

28 views

0

As software supply chain attacks and vulnerabilities become more prevalent and regulators start requiring more rigorous development processes for both open source and proprietary software, it is more important than ever to understand how secure software should be written and distributed. In this talk, we'll discuss what software supply chain security is and discuss some recent incidents that illustrate the importance of having a secure software supply chain. We'll discuss important concepts like producing a software bill of materials (SBOM), automated and reproducible builds, and provenance attestations. We’ll review the recommendations around supply chain security from open source foundations and government agencies. We'll see how open source tools like Dependabot enable companies to keep their software secure long after it’s been published, and what developers need to do to prevent their software supply chain from becoming insecure. Finally, we’ll mention some tools and processes that Java developers can use to produce secure software, and tie back all the concepts discussed to concrete, Java-specific actions. After attending this talk, audience members will know what steps are required to create a secure Java project, and will be able to upgrade the security of their Java project in case it is not already following best practices.