EP270 The Convenience Tax: Why We Keep Failing at Supply Chain Security
About this episode
The episode discusses the challenges of supply chain security and the impact of convenience on security practices.
Guest: Dan Lorenc , Founder / CEO, Chainguard Topics: We just saw a security tool (Trivy) get used to pop an AI infrastructure tool (LiteLLM) to eventually pop end users. Have we reached the point where our security tooling is actually our largest unmanaged attack surface? Why now? Software supply chain security had the perennial vibe of "not top concern" for most organizations, right? TeamPCP pushed malicious code to existing GitHub tags. We've been screaming about pinning versions to SHAs for years, but clearly, nobody is listening. Is it time to admit that 'convenience' is the primary enemy of supply chain security? The Axios incident showed a victim compromised in under two minutes. In a world of auto-updating dependencies, is the concept of a human-in-the-loop for software updates officially dead, or do we need to look very hard at version pinning and such? With XZ Utils case, we saw a long-game social engineering attack. Beyond just 'watching npm closely,' what are the realistic architectural safeguards for an org that knows they can't audit every line of an update? We've spent the last three years talking about SBOMs (Software Bill of Materials) like they were a pill for…
More episodes of Cloud Security Podcast by Google
- EP274 AI, Zero Trust and Secure by Design Walk into a Bar...
- EP273 From CISA to Cloud: AI Assurance, Concentration Risk, and the New Regulatory Frontier
- EP272 More Than Just Packets: Is NDR a "First-Class" Cloud Security Control?
- EP271 Can AI-Native MDR Actually Fix Your Broken SOC Workflows or Just Automate the Mess?
- EP269 Reflections on RSA 2026 - Beyond AI AI AI AI AI AI AI
- EP268 Weaponizing the Administrative Fabric: Cloud Identity and SaaS Compromise in M Trends 2026
Explore listener stats, chart rankings, contacts and more on the Cloud Security Podcast by Google podcast page.