Back to timeline

Beyond the Code: Securing Your Software Supply Chain

c0c0n 2023


Beyond the Code: Securing Your Software Supply Chain

In an era where up to 80% of your code can come from third parties, the security of your software supply chain is more critical than ever. Software isn’t built in silos anymore. It’s built on a complex web of dependencies, with each component sourced from different providers across the globe. This opens up a myriad of vulnerabilities, making your software supply chain a prime target for cybercriminals.

Welcome to our two-day intensive course on Software Supply Chain Security. This is not just another IT security course. It’s a journey that takes you beyond the confines of your own code, diving into the interconnected world of software development and delivery

Day 1

From the Attacker’s Perspective - Understanding Software Supply Chain Attacks

The journey begins by exploring the reality of today’s software supply chains, where the bulk of your code is sourced externally. We will dissect real-world attacks on software supply chains, understand how they unfolded, and examine their impacts.

Through hands-on exercises, you’ll step into the shoes of attackers, exploiting common vulnerabilities from developer environments and code repositories to dependencies and build/release tools. By the end of day one, you’ll fully comprehend how exposed your software supply chain could be in this interconnected digital world

Day 2:

From Vulnerability to Fortification - Securing Your Software Supply Chain

On the second day, we shift gears from understanding vulnerabilities to implementing robust defenses. We delve into industry standard frameworks such as SLSA and NIST SSDF, translating them into practical strategies for each component of your supply chain

You’ll get your hands dirty by applying these strategies to secure your developer environments, code repositories, and CI/CD pipelines. You will learn how to use Software Composition Analysis (SCA) tools to manage package/dependency vulnerabilities effectively. By the end of the course, you’ll be equipped to transform your software supply chain from a security liability to an asset.

In modern, fast-moving organizations, keeping pace with digital transformation initiatives without compromising security is a growing conundrum. This course caters to everyone in the IT industry, from developers and engineers to IT managers, security analysts, and CTOs

The nature of software development has changed; it’s high time our approach to securing it evolves too. This course offers not just knowledge, but practical skills to secure your software supply chain amidst this paradigm shift. It’s no longer enough to secure your code. You need to secure your software’s lifeline - the supply chain.

Course Content (ToC):

Day One: Understanding and Attacking Software Supply Chains

Day Two: Defending Software Supply Chains


Participants Requirements

A laptop with a modern web browser and stable internet connection. We will prefer keeping the scenarios cloud based however for some scenarios local system would be best so

we would recommend

We will need to make accounts on services like GitHub/bitbucket/AWS etc for practical hands-on experience those accounts will be created as part of the program itself (Instructions will be provided prior to the class so students can come prepared).

Who should attend:

Anyone involved in the IT industry would benefit from this course, including:

What to expect:

What not to expect:

Security is an ongoing process and this course equips you with the knowledge and skills to start and continue that journey.