How DevSecOps can Help Reduce Software Supply Chain Security Risk

The software supply chain is the series of steps involved in developing, building, and delivering software. It includes everything from external dependencies, to writing code, to deployment. Improving supply chain security can happen in tandem with "shifting left," which means incorporating security into the software development lifecycle as early as possible. This move can help to identify and fix vulnerabilities early on, before they can cause problems in production. Teams still face challenges when shifting left because, while it may help reduce the operational burden, it can add far more responsibility and potential distraction earlier in the process. This includes a high volume of false positives in vulnerability detection and the need to configure and maintain more tools in the CI/CD pipeline. In this talk, we will discuss how DevSecOps on Google Cloud can help to reduce software supply chain security risk, and in a way that introduces less friction for developers when shifting left.