Strengthening Supply Chain Security: A DevSecOps Perspective by Ankit Giri
Strengthening Supply Chain Security: A DevSecOps Perspective by Ankit Giri.
Summary
Overview: Ankit Giri of BreachLock presents at CarolinaCon on supply chain security from a DevSecOps perspective, covering risks, challenges, and solutions across the software development lifecycle.
Key Topics: Integrating security into CI/CD pipelines; Infrastructure-as-Code security gaps; AI/ML development tool risks; container and dependency scanning; and building developer-friendly security processes.
Technical Details: Giri warns that IaC templates consumed without security review propagate misconfigurations across entire infrastructures. He discusses how AI-powered development tools introduce new attack surfaces requiring updated security processes.
Takeaways: Supply chain security requires securing code before it becomes infrastructure. DevSecOps teams must address IaC, dependencies, and AI-assisted development as interconnected risk vectors.
Related talks
FIRST·48 min
Andrew Pac
Industry experts analyze emerging threats surrounding Supply Chain Security: The Office of the National Cyber Director Perspective.
The Linux Foundation·40 min
Examines strengthening Software Supply Chains: Harmonizing SLSA Provenance and SPDX SBOM for Better Adoption and evaluates key implications for security practitioners.
BSides Edmonton·54 min
Analysts investigate attack surfaces and defenses concerning Securing the Digital Supply Chain: What we should do for Supply Chain Security in DevSecOps?: Panel.