►
From YouTube: Improving Global Software Supply Chain Security with Alpha-Omega - Michael Scovetta & Michael Winser
Description
Improving Global Software Supply Chain Security with Alpha-Omega - Michael Scovetta, Principal Security PM Manager & Michael Winser, Product Manager, Google
The Alpha-Omega Project provides resources and a framework to improve the security posture of the supply chain by focusing on the most critical (Alpha) and the long-tail of open source projects. This talk will share early insights from this new program at OpenSSF.
---
Open source software is pervasive in data centers, consumer devices, and applications. Securing open source supply chains requires a combination of automated tooling, best practices, education, and collaboration.
Join the growing list of organizations supporting the advancement of securing open source technology and funding the development and adoption of OpenSSF initiatives. https://openssf.org/
A
All
right,
hi
everyone
as
established
I'm
Michael,
and
this
is
and
I'm
Michael.
We
have
a
pretty
easy
opening
going.
If
you
want
to
be
part
of
our
team
at
Alpha
Omega,
it's
super
easy.
Your
name
is
Michael.
We
don't
care
what
he
came
in
as
here.
Just
your
name
will
be
Michael
when
we're
done
so
we're
going
to
talk
to
you
today
about
Alpha
Omega,
we've
been
working
on
this
with
our
spiffy
new
t-shirts.
Thank
you
Michael,
since
2022.
A
and
our
mission,
and
we
keep
sort
of
refactoring
and
rewriting
this.
But
our
mission
is
really
is,
you
know,
simply
put.
We
can
put
a
lot
of
words
here,
but
we're,
as
I
said,
turning
money
into
security
and
we're
doing
you
know
an
effort
to
sort
of
act
now
and
if
you
think
about
the
open
ssf
as
an
awful
lot
of
amazing
work
happening
in
the
working
groups,
that
is
effectively
designing
and
planning
our
future
right.
It's
building
Technologies!
A
Let
me
listening,
but
Bob
talking
earlier
on
about
Sig
store
that
will
make
it
possible
for
us
to
do
a
better
job
of
securing
our
supply
chain
through
various
automation.
Through
insights
through
vulnerability
analysis,
all
these
different
techniques,
but
we
wanted
to
help
out
right
now
and
Microsoft
and
Google.
It
together
put
some
money
into
a
pool
and
said:
let's
go:
do
things
right
now
and
then
ask
Michael
and
Michael
Michael
to
figure
out
how
to
do
that
and
sort
of
the
end.
A
State
I
think
this
was
a
shared
vision
for
a
lot
of
the
openness
stuff,
but
it
very
much
applies
to.
What
we're
doing
is
that
the
projects,
the
most
critical
projects
are
actually
secure,
and
you
know
secure,
is
always
a
sort
of
very
variable
open-ended
space.
What
does
that
mean?
Well,
it
means
a
lot
of
things
in
terms
of
like
the
how
the
project
is
maintained,
how
it
operates
the
culture
within
that,
but
also
you
know,
vulnerabilities
are
inevitable
so
how
one's
able
to
respond
to
vulnerabilities
becomes
part
of
the
profile
of
a
security.
B
At
the
end
of
the
day,
you're
basing
your
business,
your
applications
that
your
your
livelihood
on
the
the
quality
of
the
components
that
that
you
build
in
so
really
what
we're
want
to
engender
is
is
trust
in
the
underlying
software
that
you're
using
so
that's
kind
of
the
the
end
state
of
what
it
means
to
be
secure.
Is
that
you
sleep
well
at
night,
believing
that
the
that
these
components
and
libraries
and
things
are
safe,
very.
A
Much
so
one
of
the
things
I
like
to
sort
of
explain
in
terms
of
like
what
are
the
risks
in
software
supply
chain
and
one
instead
of
correctness,
which
is
really
another
vulnerabilities.
Is
it
working
the
way
it's
supposed
to,
or
does
it
have
things
inside
there
that
allow
attacks
and
I
don't
care
about
whether
it
has
a
bug
that
causes?
You
know
some
commenting
system
not
to
comment
anymore,
I
care
that
a
bug
in
the
comedy
system
allows
somebody
to
do
sort
of
identity,
takeovers
things
like
that.
A
That's
a
that's
a
vulnerability
availability,
and
these
are
very
much
taken
analogous
from
actual
supply
chain
work
or
availability.
Is
your
Warehouse
you're
being?
Can
you
get
the
parts
you
need
to
make
your
software?
How
many
people
here
have
a
build
system
that
pulls
things
from
the
internet
live,
go
on,
put
your
hands
up.
All
of
you
put
your
hands
up
because
you
haven't
even
don't
know
it
right.
A
Your
availability
situation
is
terrible.
I
have
I
can
use
which
one
example
should
I
use.
Scrub
should
I
talk
about
left
pad.
That's
the
oldest
one
of
the
book
right,
but
faker.js
and
code.js
when
somebody
decides
to
take
their
toys
and
throw
them
out
of
the
pram,
because
they're
unhappy
with
the
state
of
Open
Source
in
some
way
right.
How
many
of
you
maintain
a
local
copy
of
either
the
artifacts
or
a
source
code
of
everything
you
depend
upon.
A
A
B
B
So,
however,
you
you
look
at
this,
you
could
think
of
it
as
a
graph
and
there's
going
to
be
a
smaller
part
of
the
at
the
top
edge
of
it,
which
are
the
very
most
critical
we've
defined
Alpha
to
be
around
100
components.
These
are
the
things
that
everyone
depends
on.
Broadly
that
a
critical
vulnerability
or
a
severe
you
know
compromise
would
take
out
a
very
large
portion
of
say
Society.
We
want
to
effectively.
You
know
ensure
that
those
are
really
secure.
B
The
way
we
do
this
is
by
basically
turning
money
into
security.
So
we've
worked
with
a
number
of
Foundations
and
we
have
one
to
announce
today
where
we
are
effectively
hiring
a
security
champ
on
behalf
well
we're
giving
money
to
the
organization
to
hire
a
security
champ
to
basically
figure
out
exactly
what
their
this.
What
their
security
posture
is,
how
to
improve.
It
would
not
we're
not
taking
a
a
super
direct
prescriptive
approach
and
you
must
do
X,
Y
and
Z.
B
We
want
the
foundation,
the
organization
itself
to
look
and
look
inward
understand
what
their
posture
is.
How
do
things
work
for
them
and
then
and
then
and
then
do
that?
It's
an
experiment,
though,
as
we
go
through
this
for
this
first
year,
we're
trying
to
figure
out
what
works
and
what
doesn't.
We
will
do
more
of
the
things
that
work
well,
we'll
do
less
of
the
things
that
work
not
well
and.
A
And
you
know
the
original
idea
for
Alpha
is
still
lurking
in
our
minds.
Also
is
we
will
have
security,
researchers
and
Engineers
on
our
teams
directly
engaging
with
key
projects
and
doing
that
sort
of
work
with
them
as
a
theme
that'll
come
up
in
this
talk
multiple
times
we're
hiring
security
engineers
and
analysts
turns
out
they're
hard
to
find
I.
Don't
know
why
this
seems
sort
of
like
a
demand
in
the
space
now
or
something
like
that
makes
no
sense
to
me.
A
B
B
We
we've
been
describing
it
as
about
10
000
projects
that
that
next
thing
that
the
next
the
next
10
000
on
the
list
and
can
we
apply
really
good
security
tools
and
expert
triage,
which
means
humans
to
basically
do
everything
that
a
tool
can
do
and
Advance
the
state
of
that
and
then
work
with
the
maintainers
to
actually
fix
the
vulnerabilities.
So
we
are
finding
new
zero
days.
We
are
reporting
them,
we
are
getting
them
fixed
or
essentially
you
can
look
at
this.
A
A
B
The
nice
thing
about
Omega
actually,
is
that
you
know
it's
in
parallel
to
lots
of
other
efforts.
So
if
you
think
of
it
in
a
perfect
world,
maintainers
are
running
these
tools
themselves,
they're
fixing
they
don't
need,
they
don't
have
anything
else
for
us
to
find
so
work
dries
up
from
Omega.
That
would
be
a
great
scenario
where
it's
all
just
built
into
the
into
the
fabric
of
how
these
these
things
are
developed
in
the
first
place.
B
A
And
and
I
think
that
there's
a
Playbook
here
right
in
terms
of
Alpha
and
Omega
and
I,
think
one
of
the
things
that
we're
learning
or
we're
not
just
sort
of
individual
techniques
or
what
works
in
one
place
another
but
like
the
whole
approach
of
Alpha
Omega.
So
if
you
think
we've
got
sort
of
the
top
areas,
we
think
we
can
do
it
Alpha
and
the
next
10
000.
We
can
think
of
that's
sort
of
an
industry-wide
perspective.
A
We're
also
not
looking
at
is
how
can
we
go
into
various
verticals
and
apply
the
same
Playbook
so
in
Industry
verticals,
where
their
top
100
projects
are
different
right?
Their
needs
are
different,
they're,
no
less
important,
and
so
you
know
taking
that
Playbook
be
able
to
say
hey.
We
did
this
really
well
for
a
general
set
of
things.
A
Can
we
go
now
and
apply
the
same
technique
and
that'll
be
different
engagements
because
either
the
sort
of
you
know,
industry
vertical,
might
have
a
foundation
that
drives
a
bunch
of
things,
but
the
projects
don't
necessarily
have
the
same
sort
of
language
or
ecosystem
based
model.
They
sort
of
show
up
in
a
variety
of
different
ways,
great
we'll
figure
out
how
to
fund
those
things
and
move
forward
there
too.
A
All
right,
hey!
We
have
news,
we
have
an
announcement
all
right.
That's
it
we're
good
right,
yeah,
okay,
that's
it!
So.
First
announcement
welcome
Anna
Anna
couldn't
be
here
today,
but
Anna
has
joined
our
team
as
a
program
manager
and
a
huge
shout
out
to
City
and
in
particular
John
medicine.
Back
there
we
have
Saturday
everyone
go
by
John
and
ask
for
him
for
more
help
for
program
management.
Apparently
he's
got
it
together.
A
I
was
like
that
was
not
in
the
script
and
we
said
script.
What
script
so
Anna
has
already
joined
the
team
been
helping
out
just
for
clarity.
You
know
Michael
and
I
have
day
jobs,
and
then
we
have
our
other
jobs,
and
this
is
our
other
other
job,
but
it's
the
one
we
like
the
most
and
Anna
helping
out
has
made
a
huge
difference
already,
so
we're
very
grateful
to
have
her
on
the
team,
and
so
let's
take
a
little
step
back
in
terms
of
like
how
have
we?
A
B
B
B
B
They
have
someone
on
staff,
they
they
hired
two
contractors
to
to
be
doing
this
work,
so
they've
been
triaging
them
they've
been
issuing
releases
they've
been
improving
the
actual
security,
the
actual
release
process
for
node
they've
had
a
node
security
working
group
that
they
had
a
few
years
ago
and
I
think
it
kind
of
died
off,
and
they
reinvigorated
that
to
the
point
that
you
know:
they're
actually
doing
substantive
improvements
to
the
to
the
node
ecosystem.
I
love
this
one.
B
This
is
great
yeah
exactly
so
so
these
are
all
you
know:
they're
building,
you
know
vulnerability,
checking
into
their
CI,
which
they
didn't
have
before
they're
doing
a
threat
model
for
node
and
that
that'll
help
them
communicate
with
researchers
on
what
they
think
of
as
a
security
vulnerability
and
even
to
the
point
of
experimental
permissions
model.
So
this
would
be,
you
know
if
you
include
left
pad,
doesn't
need
access
to
network,
so
you
don't
give
it
access
to
network
and
therefore
in
the
future,
if
it
changes
that
that's
a
runtime
error.
A
And
and
the
network
really
was,
that
proved
to
be
a
template
for
us
to
start
playing
out
in
terms
of
what
we're
doing
the
key
point
of
which
I
see.
Is
people
like
well
what
what
kind
of
terms
we
write
and
the
lawyers
I'll
get
involved?
We're
like
we're
going
to
give
them
money
and
they're
going
to
tell
us
about
it,
and
that
has
been
the
Playbook
and
it
sets
you.
Remarkably,
you
know
low
friction
and
part
of
our
success.
I
think
has
been
about
reducing
friction
every
step
along
the
way.
A
So
another
investment
was
with
the
eclipse
Foundation
a
hilariously
Mike
and
I
Mike
mckimich
from
eclipse
and
I've
known
each
other
for
like
a
long
time
and
then
something
bumped
into
each
other
in
this
various
contexts,
and
they
came
to
us
with
a
shovel
ready
set
of
efforts.
They
things
they
had
things
they
wanted
to
do.
They
had
people
they
wanted
to
hire
and
we're
like
great
here's.
Some
money
go,
do
those
things
and
within
I
think
even
before
the
check
had
cleared,
they
were
already
doing
the
work
and
so
scorecard.
A
If
you
haven't
heard
about
scorecard
already
scorecard
is
a
tool,
it's
an
open
source
project
for
evaluating
the
state
of
your
Project's
security
practices.
It
doesn't
look
at
your
code,
it
doesn't
know
much
about
your
code,
but
it
looks
at
your
repo,
looks
a
two-factor
off
and
fuzzing,
and
things
like
that
and
there's
various
ways
to
sort
of
report
a
scorecard
and
helps
you
as
an
organization
or
maintain
or
understand
what
you
could
be
doing
in
best
practices
and
it
helps
users
consuming
your
project,
understand
what
your
practices
are
and
make
their
own
decisions
about.
A
Their
security
needs
as
well.
It's
very
much
sort
of
sunshine
is
the
best
disinfected
right,
and
so
they
are
applying
scorecard
across
all
their
projects.
Identifying
workflows
already
and
made
changes,
and
you
know
they
have
a
whole
bunch
of
changes
to
planning
around
their
sort
of
branch
and
tag
rules.
They
have
we're
at
five
minutes.
We're
gonna
take
much
more
than
that.
I'm
sorry.
C
A
I'm
buying
right,
one
of
the
unique
things
about
the
eclipse
project
is
that
they
actually
have
a
fairly
sort
of
direct
control
over
a
large
number
of
their
developer
workflows.
So
they
are,
you
know.
Different
foundations
have
very
different
styles.
Some
of
them
are
very
much
the
maintainers.
Others
are
just
a
governance
body,
Eclipse
sort
of
straddles
that
has
a
fairly
active
engineering
team,
building
out
and
and
common
infrastructure
for
their
teams.
We
saw
that
as
a
very
exciting
point
of
Leverage,
so
with
crops
reminder
I
will
keep
cranking
along.
B
Too,
for
Pi
Pi,
oh
sorry,
for
pipe
or
python
sulfur
Foundation!
This
is
almost
over
the
Finish
Line.
We
announced
we
pronounce
this
in
Austin,
but
the
plan
is
for
them
to
hire
a
security,
Captain
complete
a
security
audit
of
Pi
Pi
and
essentially
do
similar
things
that
we
have
for
node
and
and
Eclipse,
but
for
for
both
pipei
and
C
python.
So
we're
really
excited
about
about.
A
It
because
I
got
the
we
have
another
announcement
and
we'd
like
to
bring
someone
up
on
stage.
Is
there
someone
we
can
pull
from
the
audience
come
on
up,
so
we're
really
excited.
This
has
been
actually
came
out
of
the
last
open,
ssf
meeting.
There's
a
microphone
here.
If
you
want
to
come
and
speak,
and
so
we're
going
to
be
putting
money
into
the
rest,
Foundation
we're
super
excited.
C
C
We
are
getting
cash
always
always
great,
but
the
really
exciting
thing
is
that
some
of
our
partners
are
kind
of
we're
using
this
to
leverage
their
resources
into
the
project
as
well.
So
our
partners,
Jay
Frog,
who
have
just
come
on
board
as
I've
gotten
a
member
to
the
foundation
jfrog,
are
actually
donating
a
security
researcher
to
us
as
part
of
this
project
as
well.
C
We
get
the
the
security
person
we
get
the
resources
from
jfrog.
We've
got
two
other
partners
that
I'm
not
allowed
to
say,
because
lawyers,
but
we're
hoping
that
they're
going
to
contribute
to
the
project
as
well.
So
we're
going
to
have
this
huge
ecosystem
of
security,
interested
people
that
hopefully
will
help
the
rest
ecosystem
grow
up
securely
and
safely.
A
That
is
fantastic
and
and
I.
Actually
we
want
to
build
what
you
said,
because
we
were
talking
about
this
earlier
on
in
terms
of
like
what
is
the
so,
how
does
alpha
omega
play
out
over
time
right
and
we
see
we're
planting
seeds,
bootstrapping
things
starting
to
create
cultures
and
improving
security,
but
also
creating
a
space
in
which
it
becomes
a
sustainable
model
for
the
organization
becomes
part
of
their
natural
funding
process.
Right
like
we
will
continue
to
support
things
and
drive
things
forward,
we're
going
to
be
here
next
year,
right.
A
Exactly
but
you
know
we
wanted
to
start
becoming
the
norm
for
how
organizations
like
yours
are
able
to
grow
and
raise
their
needs,
because
they
should
become
part
of
the
normal
process,
not
a
oh,
my
God.
We
need
help
for
this,
but
to
start
this
is
what
we're
doing
again.
Thank
you
very
much.
This
is
awesome.
Yay.
A
Thank
you
as
we're
running
out
of
time,
because
crop
is
giving
me
the
evil
eye
now
and
everybody's
thinking
about
Guinness.
You
know
we
don't
have
a
final
announcement
to
say
here,
but
we've
been
talking
to
jQuery
folks,
you
might
have
heard
of
it.
It's
a
small
little
Library
people
use
on
the
internet
somewhere
I
think
you
know
certainly
a
Target
Rich
environment
for
making
things
more
secure.
They
came
to
us
as
well
pretty
excited
about
the
opportunity
here.
It's
a
very
different
problem.
A
B
Omega,
real
quick,
we
do
have
a
the
tool
chain
that
we
developed
to
do.
This
analysis
is
now
public
you're.
Welcome
to
try
it
out.
Please
try
it
out.
Please
send
feedback.
It's
been
successful
in
finding
about
10
vulnerabilities,
important
to
note
we
haven't
actually
hired
the
security
researcher,
so
this
is
all
pre
like
experiments.
A
One
yeah
right:
that's
how
it
works
yep.
What
have
we
done?
It's
great,
what's
next,
I
think
we
hinted
that
already.
This
is
what
you
asked.
Let
me
say
this
is
dollies
yeah
yeah
when
you
say
turning
money
into
security,
yeah
8-bit,
which
I
think
is
a
great
way
because
crop
is
now
definitely
giving
me
the
like
that
blah
blah
blah
blah
blah.
Oh,
we
recently
added
sos.dev,
which
is
a
project
that
Google
initially
founded.
A
It
is
essentially
the
super
scale
thing
of
allowing
individual
contributors
to
get
paid
for
fixing
vulnerabilities
in
open
source
projects
that
that,
and
we
we're
just
still
working
with
them
to
kind
of
integrate
in
there.
But
we're
really
excited
about
the
opportunity
that
represents
as
well
all
right,
eventually
we're
hiring
we're
hiring.