ship-happens

KO | EN

gitlite — search

#ai #llm #go #golang #android #deep-learning #nodejs #java #windows #vue #security #ios #openai #open-source

(★ 10)

No description available.

ship-happens Latest Version Download

Download Latest Version (.zip)

// repository documentation

Was this content helpful?

★ 0 (0 ratings)

# Ship Happens: The Stormy Seas of Supply Chain Security

Thank you for attending my talk, please find below a list of resources to learn more about Supply Chain Security:

## Supply Chain Threat Model

- [OpenSSF Threat Model of Enterprise Open Source Supply Chains](https://openssf.org/blog/2023/09/27/threat-modeling-the-supply-chain-for-software-consumers/)

## Supply Chain Security Risks

- [Risk Explorer for Software Supply Chains](https://riskexplorer.endorlabs.com)
- [Backstabber's Knife Collection: A Review of Open Source Software Supply Chain Attacks](https://dasfreak.github.io/Backstabbers-Knife-Collection/)
- [Catalog of Supply Chain Compromises](https://github.com/cncf/tag-security/tree/main/supply-chain-security/compromises)
- [Awesome CI/CD Attacks](https://github.com/TupleType/awesome-cicd-attacks)
- [OSV Known Malware](https://osv.dev/list?q=MAL)

## Best Practises / Standards

- [OWASP Software Component Verification Standard](https://owasp.org/www-project-software-component-verification-standard/)
- [CNCF Software Supply Chain Best Practises](https://project.linuxfoundation.org/hubfs/CNCF_SSCP_v1.pdf)
- [CIS Software Supply Chain Security Guide](https://www.cisecurity.org/insights/white-papers/cis-software-supply-chain-security-guide)
- [SLSA](https://slsa.dev/)

## Developer Environment Risks

- [Can You Trust Your VSCode Extensions?](https://www.aquasec.com/blog/can-you-trust-your-vscode-extensions/)

## Open Source Dependencies

- [Top 10 Risks for Open Source Software](https://owasp.org/www-project-open-source-software-top-10/)
- [Visualize NPM Dependencies](https://npm.anvaka.com/#/)

## Repo Security

- [CIS Benchmarks for GitHub/GitLab](https://www.cisecurity.org/benchmark/software-supply-chain-security)

## CI/CD Security

- [Security hardening for GitHub Actions](https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions)
- [Top 10 CI/CD Security Risks](https://owasp.org/www-project-top-10-ci-cd-security-risks/)
- [PWN Request Threat: A Hidden Danger in GitHub Actions](https://www.endorlabs.com/learn/pwn-request-threat-a-hidden-danger-in-github-actions)
- [GitHub Actions Attack Diagram](https://github.com/jstawinski/GitHub-Actions-Attack-Diagram)
- [Continuous Integration, Continuous Destruction](https://i.blackhat.com/BH-US-24/Presentations/US24-Khan-Self-Hosted-GitHub-CICD-Runners-Continuous-Integration-Continuous-Destruction.pdf)

## Developer Training

- [Introduction to Open Source Security and Dependency Management](https://www.leanappsec.com/courses/intro-open-source-security-dependency-management)
- [Implementing Open Source Security & Dependency Management](https://www.leanappsec.com/courses/implementing-open-source-security-dependency-management)

## Tools/Utilities

- [Endor Labs Supply Chain Security Platform - 30 Day Trial](https://app.endorlabs.com/signup)
- [OWASP Dependency Track](https://owasp.org/www-project-dependency-track/)
- [OpenSSF Scorecard - Security health metrics for Open Source](https://github.com/ossf/scorecard)
- [Sigstore - code signing](https://www.sigstore.dev/)

## Blogs

- [People in your software supply chain](https://sethmlarson.dev/people-in-your-software-supply-chain)
- [Security for package maintainers](https://sethmlarson.dev/security-for-package-maintainers)

## Articles/Research/Talks

- [Endor Labs Dependency Management Report](https://www.endorlabs.com/lp/2024-dependency-management-report)
- [State of the Software Supply Chain](https://www.sonatype.com/state-of-the-software-supply-chain/Introduction)
- [Are Project Tests Enough for Automated Dependency Updates?](https://fosdem.org/2024/schedule/event/fosdem-2024-3029-are-project-tests-enough-for-automated-dependency-updates-a-case-study-of-262-java-projects-on-github/)
- [Phantom dependencies in Python](https://fosdem.org/2024/schedule/event/fosdem-2024-3146-phantom-dependencies-in-python-and-what-to-do-about-them-/)
- [Getting lulled into a false sense of security by SBOM and VEX](https://fosdem.org/2024/schedule/event/fosdem-2024-3230-getting-lulled-into-a-false-sense-of-security-by-sbom-and-vex/)

ship-happens

ship-happens Latest Version Download

Today's picks

Was this content helpful?

Recent Feedback

ship-happens

ship-happens Latest Version Download

Today's picks

Was this content helpful?

Recent Feedback

Download README