Trust No One: Securing the Modern Software Supply Chain with Zero Trust

The presentation titled "Trust No One: Securing the Modern Software Supply Chain with Zero Trust" by Emma Yuan Fang focuses on addressing the security challenges in cloud-native software development through zero trust principles.

Key Topics Discussed:

• Threat landscapes and Security Challenges: Explores various vulnerabilities within CI/CD pipelines, dependencies, and container images exploited by threat actors, and human factors like misconfigurations.
• Zero Trust Principles: Emphasizes verifying every interaction, implementing least privilege access, and assuming breach to enhance security.
• Supply Chain Attacks: Discusses notable examples such as the SolarWinds attack and dependency confusion exploits, stressing the importance of verifying code integrity.
• Practical Guidance: Offers strategies for managing and selecting dependencies responsibly, securing CI/CD pipelines, and avoiding malicious packages through techniques like digital signatures and checksum verification.
• Security Controls: Highlights the need for securing development environments and workload, implementing conditional access, and managing secrets effectively across the software supply chain.
• Artifact Integrity and Monitoring: Advises on the use of artifact signing, branch protection policies, and auditing CI/CD tools to prevent unauthorized changes.

Conclusion: The session provides a checklist for applying zero trust principles in software supply chains, encouraging organizations to prioritize critical vulnerabilities and adopt comprehensive security practices tailored to their specific environments.

This is the end of the AI-generated content.

Can you truly trust your software supply chain? As cloud-native software development surges, threat actors increasingly target the supply chain, exploiting vulnerabilities in CI/CD pipelines, dependencies, and container images. These risks can be further amplified by human factors such as misconfigurations and flawed access control policies.

In this talk, we will explore how seemingly trusted entities within your DevOps pipelines can be exploited by threat actors. We will discuss the critical need for a proactive approach to defend against upstream threats by verifying each interaction within the system. Learn how to decipher Zero Trust principles and translate them into security controls to protect your software supply chain.

Key Objectives:

• Understand the threat landscapes and security challenges in the software supply chain.
• Discuss the key principles of the Zero Trust and the advantages of applying this approach to enhance the security posture of your DevOps environment and CI/CD Pipelines.
• Lean practical guidance to defend against supply chain attacks by implementing Zero Trust Security.