Prof. Justin Cappos

Justin Cappos is a professor in the Computer Science and Engineering department at New York University, who strives to provide service to society through technology. Justin's research philosophy focuses on solving real world security problems in practice. He and his students often focus on problems in security, systems, virtualization, and software supply chain security, with an emphasis on practical research advances that can be used in production.

He is called the "Father of Software Supply Chain Security" due to his 25 years of work in this area. Among his contributions are the first attacks using dependencies, the first package manager designed for the cloud, the most widely used compromise resilient software update framework, the tag signing model used by Git, the de facto standard used to attest to what happened during a software supply chain step, and others. Many of his projects are hosted by the Linux Foundation. This includes:

• TUF, a graduated CNCF project which is used to secure software repositories both in the cloud and a variety of diverse use cases including protecting the law in Washington DC, Baltimore, the State of Maryland, and about a dozen other US jurisdictions,
• in-toto, a graduated level CNCF project, which is used by thousands of companies to attest to activities that happen in the software supply chain (and is also being extended to secure SBOMs),
• gittuf, an incubating level OpenSSF project which secures users of Git repositories and forges (e.g., GitHub, GitLab, etc.) against supply chain attacks, and
• Uptane, a JDF project for securing automotive software updaters against nation-state actors. Uptane is used across millions of devices beyond automotive, including medical devices, factory controls, drones, and other infrastructure. Uptane is both a JDF and IEEE/ISTO standard.

He created and facilitates the Linux Foundation's TAG Security and Compliance security assessment process and wrote a book about it. His open source research advances are adopted into production use by Docker, git, Python, VMware, automobiles, Cloudflare, Microsoft, Amazon, Google, IBM, Digital Ocean, and major Linux distributions. Due to the practical impact of his work, Justin was named to Popular Science's Brilliant 10 list in 2013.

I am currently recruiting talented PhD students, software engineers, research professors, and postdoctoral researchers who are interested in making a positive change in the world by building and deploying open source, real world software. Feel free to apply!

For press inquiries, please email jcappos@nyu.edu and I will respond promptly.