Linking Up The Pieces: Software Supply Chain Security at Google and Beyond

Guests:

• Eric Brewer, VP of Infrastructure, and Google Fellow @ Google
• Aparna Sinha, Director of Product Management @ Google Cloud

Topics:

• What is software supply chain security and how is it different from other kinds of supply chain security?
• What types of organizations need to care about it? Is supply chain security a concern for large, elite enterprises only?
• What's the relationship between what we're doing here, and what SBOM is?
• Can you talk us through a quick threat assessment of a supply chain security issue? What are the realistic threats here and who are the threat actors involved?
• How does Google try to solve these problems internally? Have we succeeded?
• How does this translate into our products? By the way, what's SLSA?

Resources:

• "Container Security: Building trust in your software supply chain" (live event on July 29, 2021)
• "Tracking The Trail Of Software: The Key To Boosting Security"
• "Introducing SLSA, an End-to-End Framework for Supply Chain Integrity"
• DORA study