Securing the chains: Building defensive layers for software supply chains

Overview: A security engineer at GED presents at Nullcon Goa on building developer-friendly software supply chain security programs, avoiding common anti-patterns.

Key Topics: Defining software supply chain components from code to deployment; why traditional supply chain programs fail; Docker-based scanning frameworks; and evolving toward developer-accepted security tooling.

Technical Details: The speaker advocates Docker image scanning integrated into CI/CD pipelines, providing exact runtime versions and vulnerability data that source-code-only scanning misses. The framework maps dependencies from development through deployment.

Takeaways: Effective supply chain security must be developer-friendly and integrated into existing workflows. Container-based scanning provides runtime-accurate vulnerability data that source scanning alone cannot deliver.