Software Supply Chain Security and a Decoupled Architecture (feat. Tracy Ragan)

Software Supply Chain Security and a Decoupled Architecture (feat. Tracy Ragan)

Tracy Ragan⁠ discusses software supply chain management and the importance of generating and consuming Software Bill of Materials (SBOMs) in decoupled architectures. She explains the challenges of managing libraries and dependencies in microservices and the need for aggregated SBOMs. Tracy emphasizes the importance of rapid response to vulnerabilities and the value of SBOMs in facilitating this response. She also discusses the requirements and industries for SBOMs and the role of SBOMs in analyzing and securing open source and commercial software.

Tracy introduces ⁠DeployHub⁠ as a DevSecOps evidence store that helps teams gain confidence in the use and consumption of open source software and enables rapid response to vulnerabilities.

Takeaways

  • Software supply chain management involves generating and consuming SBOMs to track libraries and dependencies in decoupled architectures.
  • In decoupled architectures, it is important to generate SBOMs for each microservice and aggregate them to understand the overall software supply chain.
  • SBOMs should be generated for every build and provide visibility into the vulnerabilities and dependencies of each component.
  • The quality of SBOMs is determined by their ability to facilitate rapid response to vulnerabilities and enable collaboration among teams.
  • While SBOMs are not currently required in all industries, their importance is increasing, especially in sectors like government and fintech. Understanding the impact of vulnerabilities is crucial for effective response and prioritization.
  • Rapid response to vulnerabilities is essential to minimize the potential impact on production environments.
  • Centralized data and information are necessary for effective vulnerability management.
  • Fixing vulnerabilities in open source software can be challenging due to the lack of accountability and maintenance.
  • Controlling open source consumption and managing the software supply chain are complex tasks.
  • DeployHub provides a DevSecOps evidence store that helps teams gain confidence in the use of open source software and enables rapid response to vulnerabilities.

Chapters

00:00 Introduction to Software Supply Chain Management

03:22 Understanding Architecture in the Context of SBOMs

06:12 Configuration Management in Monolithic Applications

07:39 Challenges of Decoupled Architecture in Microservices

09:20 The Need for SBOMs in Decoupled Architectures

11:15 Generating Aggregated SBOMs for Microservices

13:24 Generating SBOMs for Each Microservice

15:23 Generating SBOMs for Every Build

17:15 Managing Libraries and Dependencies in Decoupled Architectures

19:31 The Importance of Consuming SBOM Data

22:30 Generating SBOMs with Tools

24:28 The Format and Consumption of SBOMs

27:55 The Importance of Consuming and Analyzing SBOM Data

29:43 Requirements and Industries for SBOMs

33:29 SBOMs for Open Source and Commercial Software

36:01 The Role of SBOMs in Rapidly Responding to Vulnerabilities

39:05 The Value of SBOMs in Rapid Response Systems

43:13 Defining the Quality of SBOMs

44:06 Understanding the Impact of Vulnerabilities

46:03 The Importance of Rapid Response

48:35 The Need for Centralized Data and Information

50:27 Challenges in Fixing Vulnerabilities

52:14 The Accountability of Open Source Software

53:41 The Difficulty of Controlling Open Source Consumption

55:16 Introduction to DeployHub

57:43 Managing the Software Supply Chain

Tracy Ragan's Links:

Snowpal Products

Jaksot(410)

I do a lot of our Software Design work while walking!

I do a lot of our Software Design work while walking!

When I am sitting in front of my machine, I want to be coding (or doing something that I really need the machine for). Design work doesn't necessarily fall in that category for me - at least not all the time.

15 Tammi 20216min

Should your Product Manager have to be cognizant of your Architecture?

Should your Product Manager have to be cognizant of your Architecture?

The correct answer is "No". Or, is it? It really depends on a few different factors. Let's talk about a few pros and cons of either approach.

14 Tammi 20214min

When we embarked on building a product, we expected some challenges. But not a few others.

When we embarked on building a product, we expected some challenges. But not a few others.

I knew we would have engineering challenges and that didn't bother me (having done this for a while). But what kept me awake were the roadblocks that were bound to be there that I had little clue about!

12 Tammi 20219min

The True Cost of Meetings - it is more than what you think

The True Cost of Meetings - it is more than what you think

How much time are you spending in meetings? And are you sure you needed to be in these meetings?

10 Tammi 20219min

One approach to create UX Designs is to draw them out quickly without relying on tools

One approach to create UX Designs is to draw them out quickly without relying on tools

If you can draw, this approach will work really well! But, even if you are like me and cannot really draw, it will still save you a ton of time if you manually drew out the UI pages to share with your development team.

31 Joulu 202010min

User Experience(UX) Designs for Web and Mobile Apps

User Experience(UX) Designs for Web and Mobile Apps

While it would save time (which is priceless for everyone, not to mention smaller startups where it is even more valuable!) to use UX designs created for the Web for Mobile Apps, and vice-versa, it is hardly ever possible (if a seamless User Experience across devices is at the top of your priority list).

26 Joulu 20207min

How to deal with the issue of Bot Sign ups?

How to deal with the issue of Bot Sign ups?

Well, as technology improves, we get smarter as humans. But, so do bots. There's any number of things you can, and should, do to ensure your app is not hit with bot (aka: fake) sign ups.

26 Joulu 20202min

GitHub Projects - How we manage our repo-specific issues

GitHub Projects - How we manage our repo-specific issues

We use our own product (obviously!) to give us a federated view of all the projects that our ecosystem comprises of but at a code repository level, we use GitHub's Project feature to manage repo-specific issues. Here's how we do it.

1 Joulu 20202min