Software Supply Chain Security: Implicit Trust Will Get You Pwned

In today's software development landscape, code is often created, stored, built, and deployed across different environments, leading to significant security risks. This talk will explore the risks of our historical implicit trust model and the industry's evolving response. We will focus on software package vulnerabilities, the threat of malicious packages, and the role of attestations in enhancing security.

Speaker Name: Kyle Kelly

Speaker Bio: Kyle Kelly is the Manager of GitHub’s Package Security Team and the author of the CramHacks newsletter and blog. He is passionate about leveraging his security expertise to address today’s and tomorrow’s software supply chain security challenges, particularly in relation to open-source software. Before focusing on software supply chain security, Kyle led a team of penetration testers specializing in hacking financial institutions.