Analyzing Google's SLSA Framework for Securing Software Supply Chains

Analyzing Google's SLSA Framework for Securing Software Supply Chains

Explore Google's "Supply Chain Levels for Software Artifacts" (SLSA) framework in this 20-minute OWASP Foundation conference talk. Delve into the growing threat of software supply chain attacks and learn how SLSA aims to address this critical AppSec need. Examine the framework's approach, key areas of focus, and controls for attaining each level. Gain insights into additional aspects of software supply chain security not covered by SLSA. Understand the collapse of the SDLC into SCM and the implications for security. Analyze the framework's components, including Source, Build, Provenance, and Common elements, while identifying areas that fall outside the scope of SLSA.