Upgrade to Pro
— share decks privately, control downloads, hide ads and more …
Speaker Deck
Features
Speaker Deck
PRO
Sign in
Sign up for free
Search
Search
Supply Chain Attack
Search
Andreas Mosti
May 03, 2021
0
40
Supply Chain Attack
Talk I gave for Bekk Trondheim principles and practices group for security, spring 2021.
Andreas Mosti
May 03, 2021
Tweet
Share
More Decks by Andreas Mosti
See All by Andreas Mosti
Deterministic Builds and where to find them
andmos
0
29
Correct Maps Are Useless: A guide to mental models
andmos
0
150
LEGO I Praksis
andmos
0
54
Supply Chain Attacks: Når den digitale forsyningslinja blir angrepsvektor
andmos
0
31
IoIT: Internet of Insecure Things
andmos
0
120
Containers'n stuff
andmos
0
34
IoT - Bevisstgjøring
andmos
0
34
GitOps in a nutshell
andmos
0
180
OpenFaaS: Serverless platform with no strings attached?
andmos
0
280
Featured
See All Featured
Practical Orchestrator
shlominoach
188
11k
実際に使うSQLの書き方 徹底解説 / pgcon21j-tutorial
soudai
PRO
181
53k
The Language of Interfaces
destraynor
158
25k
How to Create Impact in a Changing Tech Landscape [PerfNow 2023]
tammyeverts
53
2.8k
Automating Front-end Workflow
addyosmani
1370
200k
Fight the Zombie Pattern Library - RWD Summit 2016
marcelosomers
233
17k
Imperfection Machines: The Place of Print at Facebook
scottboms
267
13k
Thoughts on Productivity
jonyablonski
69
4.7k
I Don’t Have Time: Getting Over the Fear to Launch Your Podcast
jcasabona
32
2.3k
Fashionably flexible responsive web design (full day workshop)
malarkey
407
66k
Helping Users Find Their Own Way: Creating Modern Search Experiences
danielanewman
29
2.7k
The Invisible Side of Design
smashingmag
299
51k
Transcript
Supply Chain Attack
What’s a supply chain?
None
None
None
Ca. 1000 parts, most of them “passive”…
But 35 critical components, single-source dependencies
None
None
None
60 top level packages 20 providers 78 top level packages
32 providers
60 top level packages 20 providers 78 top level packages
32 providers 279 total packages 39 providers 3516 total packages ???? providers
None
None
None
“In an Internet Security Threat Report, powered by Symantec, it
is stated that supply chain attacks still continue to be a feature of the threat landscape, with an increase by 78 percent in 2018.”
None
None
We go to the markedplace
None
“None of the package hosting services can ever guarantee that
all the code its users upload is malware-free”
None
Dependency Confusion
None
None
None
None
Public Package Registry Private Package Registry Package.1.0.0 Package.2.3.0 Package.99.0.0 Package.5.3.0
None
None
None
Service breaches
None
None
None
None
None
None
None
None
None
None
None
None
Worth mentioning: • Stolen signature key • Leaked API keys/passwords
• ????
How do we protect ourselves?