Paul McCarty
Paul is a DevSecOps OG and a spends most of his time red teaming the software supply chain for GitLab. He was also the founder of SecureStack, a cloud-native software supply chain security startup. Paul has worked for NASA, Boeing, Blue Cross/Blue Shield, John Deere, the US military, and Australian government amongst others. More recently Paul started SourceCodeRED.com as a way to facilitate his commercial and free training products. Paul is a frequent contributor to open source and is the author of the DevSecOps Playbook, Visualizing Software Supply Chain, TVPO threat modelling framework and several other open-source projects. He’s also a pretty good snowboarder and most importantly a husband and father to 3 amazing kids.
Session
Total attacks on the software supply chain have increased by more than 730% year on year since 2019. One way for organizations to combat this growing threat is to empower their red-teams to test the software supply chains for that organization. But many red teams are ill-prepared to tackle this new attack surface. This workshop will help existing red teams and offensive security teams learn how to expand their scope to include the software supply chain (SSC). We will give them a structured way to identify SSC components, threat model an example SSC and finally conduct red team operations on an example SSC.
I will draw on my experience at GitLab and SecureStack around red teaming and explain some of the tools and processes I've developed.
This workshop will have three parts:
- I will describe how to quickly identify the components in a software supply chain
- I will describe my TVPO methodology (target, value, patterns, and objectives) which is an applied threat modeling and assessment framework for software supply chains.
- Finally, I will describe one of my red team operations on an open source project and the tools that I use (or have written)