Trusting Your Open-Source Software Supplier - Ross Bryant, Phylum

Trusting Your Open-Source Software Supplier - Ross Bryant, Phylum

The landscape of open-source software utilization within the public sector has changed substantially over the last few years, as has the landscape and security concerns surrounding open-source software (OSS) itself. This presentation will cover some of the fundamental challenges associated with mapping OSS utilization to current policies and controls. You’ll learn best practices for complying with recent updates to the NIST SSDF and SP 800-161, as well as the new directives around Software Bill of Materials (SBOMs) to the open-source components of the software supply chain: from suppliers to artifacts, including packages, containers, and the myriad OSS tools, extensions and plugins leveraged throughout the SDLC. Additionally, this presentation will examines the fundamental security model that OSS represents, its constituent components and evolving attack surface. You’ll also hear commentary on how threat actors and their Tactics, Techniques, and Procedures (TTPs) have evolved over the last few years within the microcosm of OSS, and learn how current controls need to shift in order to address this new area of exposure.