Supply Chain Attack

Talk I gave for Bekk Trondheim principles and practices group for security, spring 2021.

Transcript

1. Supply Chain Attack
2. What’s a supply chain?
6. Ca. 1000 parts, most of them “passive”…
7. But 35 critical components, single-source dependencies
11. 60 top level packages 20 providers 78 top level packages 32 providers
12. 60 top level packages 20 providers 78 top level packages 32 providers 279 total packages 39 providers 3516 total packages ???? providers
16. “In an Internet Security Threat Report, powered by Symantec, it is stated that supply chain attacks still continue to be a feature of the threat landscape, with an increase by 78 percent in 2018.”
19. We go to the markedplace
21. “None of the package hosting services can ever guarantee that all the code its users upload is malware-free”
23. Dependency Confusion
28. Public Package Registry Private Package Registry Package.1.0.0 Package.2.3.0 Package.99.0.0 Package.5.3.0
32. Service breaches
45. Worth mentioning: • Stolen signature key • Leaked API keys/passwords • ????
46. How do we protect ourselves?