No Keys? No Problem - Why You Can Trust Sigstore Signatures
Explore Sigstore's keyless code signing, its security measures, and trust mechanisms. Learn how it protects software supply chains using open principles and robust infrastructure.
Hack Back: Learning Security with Capture-The-Flag Events
Explore state-of-art Kubernetes attack scenarios and defense strategies through Capture-The-Flag exercises. Learn to improve your organization's security using open-source tools like Simulator and Tetragon.
Supply Chain Security: Building a Knowledge Graph for Artifact Relationships
Explore a supply chain knowledge graph tool that enhances understanding of artifact relationships, enabling better assessment of vulnerabilities and dependencies in software development.
The Road to SLSA4 - Applying the Sigstore Ecosystem in a Corporate Environment
Explore Sigstore ecosystem implementation for software artifact integrity, covering self-hosting, keyless signatures, OIDC tokens, and verification methodologies in various environments.
SBOM is Coming - Why You Should Care and How You Can Help
Explore the importance of Software Bill of Materials (SBOM) in cloud-native ecosystems, its impact on security, and how you can contribute to its implementation and adoption.
Keeping Up with CVEs: Finding Needles in Haystacks - Practical Vulnerability Assessment
Discover practical approaches to assess product security beyond raw vulnerability numbers, focusing on risk assessment and understanding scanner limitations in container image analysis.
Cryptographic Signatures - A Building Block Not A Panacea
Explore cryptographic signatures in software supply chain security, their benefits, limitations, and effective implementation strategies for cloud-native applications.
SPIFFE: In Theory and Practice - Deep Dive and Q&A
Explore SPIFFE's vision, components, and role in cloud-native environments. Learn about the SPIFFE specification, IDs, naming, and trust domains in this informative deep dive with Q&A.
Shifting Security Left - Simplifying Security for Kubernetes and OpenShift Environments
Learn to simplify security in Kubernetes and OpenShift, focusing on authentication, secrets management, and bridging the gap between security and DevOps for more efficient cloud-native environments.
Demystifying Zero-Trust for Cloud Native Technologies
Explore zero-trust principles for cloud-native environments, covering identity, policy, continuous assessment, and security. Learn implementation guidelines for protecting users, devices, networks, applications, and data.
Security as Code - A DevSecOps Approach
Explore DevSecOps and Security as Code with CodeQL. Learn to implement security checks, detect vulnerabilities, and foster collaboration between development and security teams for a robust security culture.
Software Supply Chain Security with TAG Security
Explore software supply chain security with insights on guidance, resources, and recent developments. Learn about the whitepaper, compromise catalog, and reference architecture for secure supply chains.
Untrusted Execution - Attacking the Cloud Native Supply Chain
Explore cloud native supply chain vulnerabilities, threat modeling, and security controls. Learn about trusted execution environments and end-to-end security solutions for protecting complex systems.
Security Threat Modeling Live from Scratch Session
Hands-on workshop demonstrating lightweight threat modeling for CNCF projects, led by Andrew Martin. Learn practical techniques to identify and mitigate security risks in cloud-native environments.
SBOMs, VEX, and Kubernetes - Software Supply Chain Security in Cloud Native Environments
Explore software supply chain security with experts discussing SBOMs, VEX, and their practical applications in Kubernetes environments, from open-source projects to regulated industries.
Secure Your Software Supply Chain Using Observability
Explore techniques for enhancing software supply chain security through observability, focusing on key benefits and practical implementation strategies.
Securing the Supply Chain with Witness - A Framework for Supply Chain Security
Explore Witness, an open-source framework for supply chain security, its trust model, and implementation in CI pipelines. Learn about attestation collections, policy enforcement, and integration with cloud-native tools.
Dissecting the 0-Day Supply Chain Vulnerability in Argo CD
Explore the discovery and implications of a critical 0-day vulnerability in Argo CD, including attack methods, remediation steps, and its impact on the ecosystem.
CNCF End User Technology Radar for DevSecOps - September 2021
Explore DevSecOps trends and recommendations from CNCF's End User Community. Gain insights on security solutions, micro-segmentation, and balancing security with developer experience in cloud-native environments.
Certs Magic - Exploring Cloud Native Security Certifications
Explore the world of cloud native certifications with expert Walid Shaari, gaining insights into career advancement and industry-recognized credentials.
Envoy Gateway End User Threat Model Report: Raising Awareness of Gateway API Security
Explore Envoy Gateway's security through a threat-driven analysis, providing insights for confident deployment as an edge proxy in Kubernetes clusters.