DevOps Speakeasy with Lori Lorusso and Ixchel Ruiz at #Devnexus 2023

hi hello we are here at darkness and

Speak Easy and I’m super thrilled to

have us

good speaker

of our next session

here Lori Lulu

hey y’all

I’m excited and nervous but I am very

happy to be presenting with someone who

did not introduce herself

if you know her you know she’s a Java

Champion she’s super amazing and we are

talking about software supply chain

security and different projects that you

can use that are open source to help

secure your software supply chain

Yes actually that’s one of the main

topics that we like to talk about and in

this conference I think we have a lot of

opportunity to reach the developers and

make sure that they are taking the right

opportunities and doing the right things

to help in this in this path security is

something that affect us at the end of

the day I’m a consumer software I’m not

only a producer software I’m also a

consumer of software which means that I

flew here I pay with a credit card my

hotel and so whenever developers don’t

take this matter Security in itself and

reliability and quality

it there is somebody that is going to

live the consequences of that and most

of the cases that person is actually

going to be here

it’s not going to be me but what I am is

a consumer consumer and so but there are

a couple of the attacks that we’re going

to talk about that are pretty famous

there was a target attack in 2013

British Airways in 2018 and then I think

the one everybody knows of solarwinds in

2020. now why are all of these important

it’s because they are all supply chain

attacks so in Target they attack the

point of sale system how did they attack

their point of sale system they went in

through their HVAC system that’s right

they targeted the HVAC system which then

went ahead and spread a virus on all the

point of sale systems which caused

202 million dollar loss for Target now

can you imagine being the developer that

gets the phone call that said hmm

something’s up we don’t know what’s

going on and then 202 million dollars

later there you are

and so this is important

and that was 2013 y’all and it’s 2023

now so you can only imagine how much

smarter the attackers have gotten yes

and the surface that they are dealing

with it’s even bigger so now we have to

start thinking about doing more stuff

more frequent and investing more I mean

it’s a good thing and a bad thing that

security

and supply chain attacks have increased

so much it’s a bad thing because it’s

affecting everybody but the good thing

is that we also now pushing by the

Numbers the idea that we need to deal

with this problem now is no longer a

thing of the past and it’s no longer an

afterthought today

most companies regardless of the

industry they are their first priority

one of the top three priorities is

security so that’s why I mean I mean

it’s sad that we learn

with pain

but the amount of attention that we have

right now is impressive

and as developers not only we have the

Civic and moral responsibility to do

something about it now we also have the

requirements and specification

compliance and everybody looking at us

and saying you know what this is your

problem

this is not a conversation that we have

to have after you release

your software this is a conversation

that we are adding to your daily lives

since day one

and you know what that actually

brings more responsibilities more ideas

more concerns that we never thought

about it and now we have them which in

principle it’s annoying but in the

second reading of this

having it in the Forefront of your mind

make it easier to address

and speaking of addressing all of these

issues you might be thinking well my

brain is just exploding like I don’t

know what to do or where to start and so

that’s why we start with open source and

so we’re going to mention a few open

source organizations that are working to

help secure the supply chain one is the

CDF continuous delivery Foundation then

we talk about openssf as well as owasp

but there are a ton of other

organizations out there that are working

in a vendor neutral collaborative way to

solve the supply chain security issue

and security issues in general and I

think that’s one of the things that

makes technology and development so

exciting is the ability to work in open

source the ability to work

collaboratively with companies that may

be thought of as your competitors but

you’re all trying to work to solve the

same problem in a common and

collaborative manner

so if you want to learn more about all

these foundations because we are part of

several of them

I am the open source program manager at

jfrog just saying it’s my title but not

only that she sits at so many boards and

working group and security

so it’s like she’s not putting it out on

me like I’m just saying like as a

company we’re very lucky or that we work

for a company that puts value in working

collaboratively with other companies and

working on these foundations to be able

to be at the Forefront and The Cutting

Edge to know what’s going on how to help

solve these problems exactly so thank

you very much and see you in the next

conference peace

foreign