Scott Norris | Solutions Architect
Chainguard

Day 2 @ 11:40

Secure by default: Restarting the clock

• Australia's current frameworks are losing the race — the ISM and PSPF recommend supply-chain assurance but mandate no provenance, only 22% of Commonwealth entities meet Essential Eight ML2, and AI-speed attackers have turned "patch within two weeks" into a head start for the adversary. The US and EU have already mandated what we still suggest.
• Close the gap with architecture, not another policy — software rebuilt from source daily, signed, with SBOMs and provenance by default delivers ~97.6% fewer CVEs and 1-day remediation of known exploited vulnerabilities. Compliance becomes a property of the artifact, not a reporting exercise.
• Works with the frameworks you already run — direct alignment to the Essential Eight, ISM and PSPF (FIPS 140-3, IRAP and EU CRA covered by default), plus pre-disclosure coordinated defence: shipping the fix before the vulnerability is ever public.

Scott Norris, Solutions Architect, Chainguard

×

Scott Norris / Secure by default: Restarting the clock

Scott Norris, Solutions Architect,
Chainguard

Scott Norris is a Principal Solutions Engineer at Chainguard, where he helps government and defence organisations secure their software supply chains with build-from-source SDLC artifacts, like zero-CVE, hardened container images and Node, Python, and Java development libraries, Skills and Actions...

CloseMore