Software Supply Chain Security and a Decoupled Architecture (feat. Tracy Ragan)

Software Supply Chain Security and a Decoupled Architecture (feat. Tracy Ragan)

Tracy Ragan⁠ discusses software supply chain management and the importance of generating and consuming Software Bill of Materials (SBOMs) in decoupled architectures. She explains the challenges of managing libraries and dependencies in microservices and the need for aggregated SBOMs. Tracy emphasizes the importance of rapid response to vulnerabilities and the value of SBOMs in facilitating this response. She also discusses the requirements and industries for SBOMs and the role of SBOMs in analyzing and securing open source and commercial software.

Tracy introduces ⁠DeployHub⁠ as a DevSecOps evidence store that helps teams gain confidence in the use and consumption of open source software and enables rapid response to vulnerabilities.

Takeaways

  • Software supply chain management involves generating and consuming SBOMs to track libraries and dependencies in decoupled architectures.
  • In decoupled architectures, it is important to generate SBOMs for each microservice and aggregate them to understand the overall software supply chain.
  • SBOMs should be generated for every build and provide visibility into the vulnerabilities and dependencies of each component.
  • The quality of SBOMs is determined by their ability to facilitate rapid response to vulnerabilities and enable collaboration among teams.
  • While SBOMs are not currently required in all industries, their importance is increasing, especially in sectors like government and fintech. Understanding the impact of vulnerabilities is crucial for effective response and prioritization.
  • Rapid response to vulnerabilities is essential to minimize the potential impact on production environments.
  • Centralized data and information are necessary for effective vulnerability management.
  • Fixing vulnerabilities in open source software can be challenging due to the lack of accountability and maintenance.
  • Controlling open source consumption and managing the software supply chain are complex tasks.
  • DeployHub provides a DevSecOps evidence store that helps teams gain confidence in the use of open source software and enables rapid response to vulnerabilities.

Chapters

00:00 Introduction to Software Supply Chain Management

03:22 Understanding Architecture in the Context of SBOMs

06:12 Configuration Management in Monolithic Applications

07:39 Challenges of Decoupled Architecture in Microservices

09:20 The Need for SBOMs in Decoupled Architectures

11:15 Generating Aggregated SBOMs for Microservices

13:24 Generating SBOMs for Each Microservice

15:23 Generating SBOMs for Every Build

17:15 Managing Libraries and Dependencies in Decoupled Architectures

19:31 The Importance of Consuming SBOM Data

22:30 Generating SBOMs with Tools

24:28 The Format and Consumption of SBOMs

27:55 The Importance of Consuming and Analyzing SBOM Data

29:43 Requirements and Industries for SBOMs

33:29 SBOMs for Open Source and Commercial Software

36:01 The Role of SBOMs in Rapidly Responding to Vulnerabilities

39:05 The Value of SBOMs in Rapid Response Systems

43:13 Defining the Quality of SBOMs

44:06 Understanding the Impact of Vulnerabilities

46:03 The Importance of Rapid Response

48:35 The Need for Centralized Data and Information

50:27 Challenges in Fixing Vulnerabilities

52:14 The Accountability of Open Source Software

53:41 The Difficulty of Controlling Open Source Consumption

55:16 Introduction to DeployHub

57:43 Managing the Software Supply Chain

Tracy Ragan's Links:

Snowpal Products

Episoder(415)

Kanban Views - For those of us who love to see all our content in a Kanban!

Kanban Views - For those of us who love to see all our content in a Kanban!

And even for the rest of us who don't always prefer a Kanban View for everything, there are some scenarios in which we definitely look forward to using Kanban Views.

11 Jul 20207min

Facebook ADs: Campaigns, AD Sets and ADs

Facebook ADs: Campaigns, AD Sets and ADs

If you have never created a Facebook Campaign before, and are just getting started, it may take a tiny bit of getting used to. Here's how I went about creating my campaigns for our SaaS platform (snowpal.com).

11 Jul 20205min

NoSQL vs SQL - what might you want to go with

NoSQL vs SQL - what might you want to go with

Besides the obvious differences, there are a few reasons why I prefer one over the other, entirely driven by the nature of the problem I am trying to solve.

11 Jul 202056s

Our Git Workflow Process - after numerous tweaks, here's one that works beautifully for us.

Our Git Workflow Process - after numerous tweaks, here's one that works beautifully for us.

As we all know, git is a piece of wonder. But, it still takes a little bit of time to arrive at the workflow that works best for you (given that it depends on a variety of factors). Here's one that works for us.

11 Jul 20204min

Our SaaS Platform - a quick look at the Dashboard

Our SaaS Platform - a quick look at the Dashboard

Snowpal Pitch is a powerful SaaS platform that lets you stay organized in all walks of life. Here's a quick 1-minute video on one of the many features (the first one you would encounter after you sign in - "Dashboard").

11 Jul 20201min

Aspect Programming (or even other flavors of it) come in real handy to solve certain types of problems

Aspect Programming (or even other flavors of it) come in real handy to solve certain types of problems

If you want to add or improve your logging or caching layers, you definitely want to consider doing them using Aspect Programming. Those are some common examples but there are numerous scenarios where touching your "core" coding layers (or, tiers or services) is not a good idea. Aspects come in quite handy on those occasions.

11 Jul 20204min

Come up with a design (in mind) before you get to your computer

Come up with a design (in mind) before you get to your computer

To make the best use of your time at work, and/or when you are in front of a machine, it is a good idea to come up with a design (no matter how high level) in mind. This way, you can hit the ground running when you get to your machine. I've seen time and again that this approach works for me.

11 Jul 20201min

Populært innen Teknologi

romkapsel
smart-forklart
rss-avskiltet
teknisk-sett
lydartikler-fra-aftenposten
energi-og-klima
rss-impressions-2
nasjonal-sikkerhetsmyndighet-nsm
rss-alt-vi-kan
hans-petter-og-co
teknologi-og-mennesker
shifter
fornybaren
rss-alt-som-gar-pa-strom
tomprat-med-gunnar-tjomlid
pedagogisk-intelligens
i-loopen
energipafyll
rss-heis
elektropodden