Topics Software Supply Chain Security · 2:56 A deep dive into the critical vulnerabilities that emerge when software supply chains are disrupted by vendor shutdowns, registry outages, and geopolitical tensions—revealing how quickly a broken pipeline can leave you completely exposed.
Service Cutoff Scenarios Software Supply Chain Security · 2:46 A deep dive into the fragile dependencies modern software pipelines have on external registries and services, exploring what happens when geopolitical events, outages, or access restrictions suddenly cut off critical infrastructure your builds rely on.
Legal Prohibition Risks Software Supply Chain Security · 3:19 Exploring the often-overlooked legal risks embedded in software supply chains, this song breaks down how export controls, trade sanctions, and international restrictions can suddenly make your dependencies illegal — and why knowing where your code comes from is as critical as knowing what it does.
Geopolitical Risk Types in Tech Software Supply Chain Security · 3:49 Exploring how geopolitical tensions create three distinct categories of risk for technology systems, this track breaks down how access denial, legal conflicts, and ownership disputes can disrupt the software supply chain when national borders collide with digital infrastructure.
Ownership Change Threats Software Supply Chain Security · 6:19 Exploring the hidden risks that emerge when software vendors change hands, this chapter examines how mergers and acquisitions can suddenly disrupt trusted dependencies, alter license terms, and destabilize the very foundation your software stack is built upon.
Open Source Dependency Vulnerabilities Software Supply Chain Security · 4:17 A deep dive into the hidden risks lurking within open source dependencies, exploring how modern software projects can be left dangerously exposed when the libraries they rely on become abandoned, unmaintained, or compromised.
Source vs. Operational Availability Software Supply Chain Security · 3:05 Exploring the critical difference between finding open source code and actually getting it to work, this chapter reveals the hidden challenges of dependencies, build tools, and documentation that stand between discovering a library and successfully deploying it in your environment.
Building Resilient Tech Architecture Software Supply Chain Security · 5:13 Explores how to design robust, distributed tech infrastructure that can withstand geopolitical disruptions and system failures by leveraging multi-cloud and multi-zone strategies to eliminate dangerous single points of failure.
Exercises Software Supply Chain Security · 4:20 A hands-on exploration of ten real-world scenarios where geopolitical shifts and policy changes challenge mobile app security, teaching listeners how to navigate data sovereignty and cross-border infrastructure decisions.
Supply Chain Risk Assessment Framework Software Supply Chain Security · 3:52 A deep dive into the geographic and geopolitical forces that shape software supply chain vulnerability, teaching listeners how to map dependencies across global infrastructure and assess the stability risks tied to every layer of their technology stack.
Topics Software Supply Chain Security · 2:57 Dive into the world of software dependencies, where every package you install brings along a hidden web of additional components you may not even know exist.
Dependency Graphs: The Web of Code Dependencies Software Supply Chain Security · 3:59 Dependency graphs reveal how a single library import can trigger a cascade of hidden transitive dependencies, and listeners will learn how to navigate and understand the complex web of relationships that modern software projects quietly accumulate beneath the surface.
Dev vs Runtime: Different Dependencies for Different Times Software Supply Chain Security · 3:09 A deep dive into the critical distinction between development and runtime dependencies, teaching listeners how to keep production environments lean by ensuring tools like testing frameworks and linters stay out of shipped software.
Language Ecosystems: Package Managers Across the Stack Software Supply Chain Security · 4:43 Explore how different programming languages manage their dependencies through dedicated package managers like npm, PyPI, and Cargo, and why understanding these ecosystem-specific tools is foundational to securing your software supply chain.
Artifact Provenance: From Source to Binary Software Supply Chain Security · 4:04 Tracing the journey of software from its origins in source code through the build process to its final released form, this chapter illuminates how artifacts gain their own distinct identity—and security considerations—at each stage of the supply chain.
The Reproducibility Problem: Same Code, Different Results Software Supply Chain Security · 2:34 Reproducibility in software builds is trickier than it looks — even identical code can produce different binaries depending on compiler versions, flags, and environment variables. You'll learn why deterministic builds matter for supply chain security and what subtle factors silently undermine them.
Supply Chain Attack Vectors: Where Dependencies Go Wrong Software Supply Chain Security · 3:55 Tracing how a single compromised dependency can silently unravel an entire software ecosystem, this chapter exposes the real-world vulnerabilities hiding inside trusted package registries and what happens when a maintainer's account falls into the wrong hands.
Geopolitical Risks in Global Package Registries Software Supply Chain Security · 3:34 Explore how international conflicts, sanctions, and geopolitical tensions can disrupt access to the global package registries and open-source dependencies that software teams rely on every day.
Building Resilient Dependency Strategies Software Supply Chain Security · 3:53 Discover how to protect your software from the cascading failures that occur when dependencies break or disappear, and learn the battle-tested strategies that keep your applications running even when supply chains crumble.
Exercises Software Supply Chain Security · 4:13 A hands-on guide to mapping the full dependency tree of a software service, Exercises walks listeners through tracing direct and transitive dependencies to reveal the hidden complexity lurking beneath the surface of every package.
Topics Software Supply Chain Security · 4:09 A deep dive into software supply chain security, exploring how standards like SPDX and CycloneDX help track dependencies and legal rights, while also uncovering the critical gaps these tools leave behind when it comes to runtime context.
SBOM Fundamentals: What Are Software Bills of Materials? Software Supply Chain Security · 3:24 Diving into the foundational concept of Software Bills of Materials (SBOMs), this chapter explores why modern software's layered dependencies create hidden security risks and how an SBOM serves as a critical map for identifying every component within your software supply chain.
SPDX Standard: Structure and Applications Software Supply Chain Security · 3:27 Explore how the SPDX standard, developed by the Linux Foundation, brings order to the complex world of software licensing by providing a structured format for tracking and communicating package information across the software supply chain.
CycloneDX Standard: Security-Focused SBOM Format Software Supply Chain Security · 3:59 Dive into CycloneDX, the OWASP-born SBOM standard purpose-built for security, and discover how its flexible JSON and XML formats help teams systematically map and track every component in their software supply chain.
Build-Time vs Repo-Time SBOM Generation Software Supply Chain Security · 3:03 Exploring the critical decision of when to generate a Software Bill of Materials, this track breaks down the key differences between build-time and repository-time SBOM generation, revealing why timing directly impacts the accuracy of what components are actually captured in your final software.
Container SBOM Generation: Images and Layers Software Supply Chain Security · 3:31 Diving into the complexities of container image composition, this chapter explores how each layer of a container—from base OS to installed applications—contributes to your Software Bill of Materials, and how to accurately capture dependencies across multi-stage builds.
OS Package SBOMs: System-Level Dependency Tracking Software Supply Chain Security · 2:59 Diving into the world of operating system package SBOMs, this chapter explores how system-level dependencies are tracked across package managers like APT, YUM, and DNF, revealing the hidden risks of supply chain attacks lurking within your software's foundational layers.
Component Identity: Names, Versions, and Hashes Software Supply Chain Security · 5:03 Dive into the foundational building blocks of software component identity, exploring how names, version numbers, and cryptographic hashes work together to uniquely identify and track the packages that make up your software supply chain.
Build Metadata and Provenance in SBOMs Software Supply Chain Security · 4:39 Dive into the critical practice of capturing build metadata and provenance within SBOMs, learning how to document every tool, environment, and timestamp that shapes your software artifacts into a verifiable, trustworthy record.
Vendored Code and Forks: Complex Dependency Scenarios Software Supply Chain Security · 4:27 Navigating the tricky terrain of vendored code and forked repositories, this chapter explores how to manage complex dependency scenarios when upstream libraries are abandoned or unreliable, and how to accurately document these deviations in your Software Bill of Materials.
Private Dependencies and Internal Components Software Supply Chain Security · 3:24 Navigating the complexities of software supply chains becomes especially challenging when proprietary code and internal libraries enter the picture, and this chapter tackles how to build accurate SBOMs while keeping sensitive component details secure and unexposed.
Exercises Software Supply Chain Security · 2:49 Hands-on practice reinforces the critical skills of implementing Software Bills of Materials and securing CI/CD pipelines, giving listeners the practical experience needed to build and verify trustworthy software supply chains.
Topics Software Supply Chain Security · 3:40 A deep dive into the hidden vulnerabilities lurking in modern software supply chains, exploring how attackers exploit trust through tactics like social engineering, dependency confusion, and typosquatting to sneak malicious code into the packages developers rely on every day.
Exercises Software Supply Chain Security · 3:35 A hands-on exploration of software supply chain security fundamentals, guiding listeners through practical exercises that build trust and integrity across every stage of the development and deployment process.
Topics Software Supply Chain Security · 3:02 A deep dive into the often-overlooked ownership and origin factors of software components, teaching listeners how vendor domicile, parent companies, and acquisition history can dramatically impact the security and licensing status of the packages they depend on.
Exercises Software Supply Chain Security · 4:41 A hands-on exploration of software supply chain dependencies, examining how major projects like React are governed and hosted, and what single points of failure mean for the millions of developers who rely on them daily.
Exercises Software Supply Chain Security · 3:42 A hands-on exploration of supply chain failure scenarios, teaching listeners how to identify critical vulnerabilities and build resilient response playbooks when interconnected systems begin to cascade and fail.
Topics Software Supply Chain Security · 4:12 A foundational overview of software supply chain security, exploring how modern tech stacks rely on countless external components and why understanding the origins and risks of those dependencies is critical to building trustworthy systems.
Exercises Software Supply Chain Security · 3:31 A deep dive into the five key pillars of supply chain security audits, this track walks listeners through the essential documentation and evidence needed to demonstrate compliance, from Software Bills of Materials (SBOMs) to vendor management practices.
Topics Software Supply Chain Security · 4:54 A broad look at the full scope of software supply chain components, revealing how vendor relationships extend far beyond SaaS to encompass open source dependencies, registries, build tooling, certificate stores, and app marketplaces.
Exercises Software Supply Chain Security · 2:35 A deep dive into the critical questions and criteria you should apply when evaluating vendors for your software pipeline, covering everything from secret storage practices to backup protocols and compliance verification.
Topics Software Supply Chain Security · 3:02 Explore the hidden vulnerabilities lurking in third-party platform dependencies, from app store SDKs to cloud services, and learn how vendor lock-in and proprietary tools can put your software supply chain at risk.
Topics Software Supply Chain Security · 4:39 A deep dive into securing your software pipeline, covering ephemeral build environments, least-privilege access, secret management, dependency pinning, and code signing to protect your supply chain from end to end.
Exercises Software Supply Chain Security · 3:18 A deep dive into the vulnerabilities lurking within software supply chains, teaching listeners how to identify dangerous chokepoints—from hardware dependencies to single-vendor risks—and build practical substitution strategies before those weaknesses become costly failures.
Exercises Software Supply Chain Security · 3:35 A hands-on walkthrough of responding to a compromised dependency alert, guiding listeners through the critical first steps of checking CVE databases, reviewing security feeds, and using version control to trace when a vulnerable package entered their supply chain.
Topics Software Supply Chain Security · 4:23 A deep dive into the complex world of data sovereignty and jurisdictional compliance, exploring how enterprises navigate the legal and regulatory challenges that arise when data, code, and users exist across multiple geographic locations.
Exercises Software Supply Chain Security · 3:51 A deep dive into the principles of access control and administrative boundaries, this chapter challenges listeners to think critically about how organizations can architect secure systems by limiting and containing privileged actions within defined zones.
Topics Software Supply Chain Security · 3:04 A deep dive into disaster recovery fundamentals, breaking down criticality tiers and key metrics like RTO and RPO to help you prioritize systems and plan effectively when things go wrong.
Exercises Software Supply Chain Security · 3:09 A hands-on deep dive into supply chain security assessment, this chapter walks listeners through the critical practice of auditing software dependencies, mapping vendors, and questioning every layer of your digital infrastructure to determine true technological sovereignty.
Digital Footprints in the Code Software Supply Chain Security · 4:03 Explore how every piece of software leaves behind a traceable trail of compiler fingerprints, build environment details, and timestamp signatures. Listeners will learn how these digital artifacts capture the precise conditions under which code was created, forming a critical foundation for supply chain accountability.