Shielding Software Supply Chain With Francois Proulx

For application security, start with threat modeling including context. Look at all our architecture diagrams and start evaluating from an attacker's mind.When using open source dependencies, start with a baseline vulnerability scan and do a continuous process to review and evaluate dependencies.Understand dependencies, SBOM to verify validity of dependencies. One of the tools to do this is deps.dev.

In this Scale to Zero podcast episode, we had the very cool Francois Proulx! With his expertise in Software Supply Chain Security and Application Security, he shared some really deep and helpful thoughts in this field. He has also shared some resources for folks who are getting started.

You can read the complete transcript of the epiosde here >

Learnings from the podcast

For application security, start with threat modeling including context. Look at all our architecture diagrams and start evaluating from an attacker’s mind.
When using open source dependencies, start with a baseline vulnerability scan and do a continuous process to review and evaluate dependencies.
Understand dependencies, SBOM to verify validity of dependencies. One of the tools to do this is deps.dev.