/2024/ Recent content in 2024s on SCORED '26 Conference Hugo -- gohugo.io en-us /2024/call_for_papers/ Mon, 01 Jan 0001 00:00:00 +0000 /2024/call_for_papers/ Call for Papers/Talks The SCORED workshop invites academia, industry, and governmental entities to submit original research papers or security-in-practice talks concerning the security of software supply chains from both technical and policy perspectives. Suggested topics include, but are not limited to: Attacks on the software supply chain Securing source control Trustworthy builds Reproducible builds Secure CI/CD Code signing Integrity for container images Package management security Code dependency tracking and patch propagation Auditable storage for metadata Software updates Developer identity management Code vulnerability tracking and disclosure as well as vulnerable code-clone detection Static analysis Hardware-assisted software supply chain integrity Software bills of materials (SBOMs) Specification of supply chain security policies Tools for securing the SW supply chain Interfacing the hardware and software supply chains Surveys or Systemization of Knowledge (SoK) of the SW supply chain security landscape Public policy around SW supply chain security SW supply chain security best practices Standards Domain-specific software supply chains (voting, finance etc) Security economics Human behavioral and measurement studies, e. /2024/committee/ Mon, 01 Jan 0001 00:00:00 +0000 /2024/committee/ Committee Workshop Chairs Santiago Torres Arias, Purdue Program Chairs Lorenzo De Carli, University of Calgary Yuchen (Dennis) Zhang, NYU Steering Committee Marcela Melara, Intel Labs Program Committee Aditya Sirish A Yelgundhalli, New York University Adriana Sejfia, University of Edinburgh Ahmad Abdellatif, University of Calgary Behnaz Hassanshahi, Oracle Labs Benoit Baudry, Université de Montréal Dennis Roellke, Bloomberg Dominik Wermke, NC State Drew Davidson, University of Kansas Elizabeth Wyss, University of Kansas /2024/contact/ Mon, 01 Jan 0001 00:00:00 +0000 /2024/contact/ /2024/home/ Mon, 01 Jan 0001 00:00:00 +0000 /2024/home/ /2024/keynote/ Mon, 01 Jan 0001 00:00:00 +0000 /2024/keynote/ Keynote Insane in the AI Supply Chain: Attacks, defenses and open questions Eoin Wickens, Director of Threat Intelligence, HiddenLayer Abstract A supply chain attack can be incredibly damaging, far-reaching, and an all-around terrifying prospect that has been carved into the collective memory of security practitioners and executive leadership alike. Over the last three years since significant incidents like Solarwinds and Kaseya, the industry has made great strides in securing software supply chains, determined not to make the same mistakes again. /2024/panel/ Mon, 01 Jan 0001 00:00:00 +0000 /2024/panel/ Panel Discussion: ML (for) Supply Chain Security: Promises, Pitfalls and Opportunities Machine learning (ML) has become ubiquitous in assisting us in tasks as mundane as sending text messages and as critical as diagnosing cancer in patients. The emergence of generative AI (GenAI) over the past few years has opened further opportunities in other domains. For software development, in particular, there’s been a lot of recent talk about how GenAI shows promise for improving the security of tasks like coding, application testing and vulnerability analysis. /2024/program/ Mon, 01 Jan 0001 00:00:00 +0000 /2024/program/ 2024 Workshop Agenda All times are in Mountain Daylight Time. Opening Remarks and Awards (9:00 AM) PC Chairs Keynote Talk (9:10 AM) Insane in the AI Supply Chain: Attacks, defenses and open questions Eoin Wickens, Director of Threat Intelligence, HiddenLayer Break (10:00-10:15 AM) Technical Session 1: Building Trust in Software Supply Chains (10:15 AM) Session Chair: Martin Schwaighofer (Johannes Kepler University Linz) Enhancing Transparency and Accountability of TPLs with PBOM: A Privacy Bill of Materials Yue Xiao (IBM), Adwait Nadkarni (William & Mary), Xiaojing Liao (Indiana University) /2024/workshop_information/ Mon, 01 Jan 0001 00:00:00 +0000 /2024/workshop_information/ About SCORED Overview Every single piece of software running on every computing device today is produced through a complex supply chain that often involves a myriad of individuals and spans multiple organizations and administrative domains. Recent attacks on the software supply chain have shed light on the fragility and importance of ensuring the security and integrity of this vital ecosystem. Addressing the technical and social challenges to building trustworthy software for deployment in sensitive and/or large-scale enterprise or governmental settings requires innovative solutions and an interdisciplinary approach.