Demystifying Unreproducible Builds: What, Why, and How
Explore reproducible builds as a defense against software supply chain attacks, understanding their importance and implementation strategies for enhanced security.
Simplifying Coordinating Vulnerabilities and Disclosures in Open Source Projects
Learn best practices for handling vulnerability disclosures in open source projects. Discover tools and templates to streamline the process and reduce stress when dealing with security reports from researchers.
Securing Your Software Supply Chain
Explore the current state and future of JavaScript ecosystem security, learn about emerging tools to combat threats, and discover practical strategies to protect your software supply chain.
Navigating Open Source and Open Standards for Better Cybersecurity
Explore the interplay between open source and open standards in cybersecurity, examining their roles in shaping the IT ecosystem and addressing modern software supply chain concerns.
Zero Trust: Getting to Step One and What to Do When You Get There
Explore Zero Trust fundamentals and learn practical strategies for implementing this security approach in your organization, from initial workload migration to future steps.
SLSA Conformance - Understanding Build System Requirements and Trust Decisions
Explore SLSA framework for software artifact integrity, build system requirements, conformance program, and trust decision enforcement in supply chain security.
Open Source Supply Chain Security - Are Containers the Biggest Blind Spot?
Experts discuss open source supply chain security, focusing on container vulnerabilities, SBOMs, and best practices for managing security in modern engineering toolchains.
Code Genome - Fingerprinting Code to Build Trustworthy SBOMs
Explore Code Genome, a novel approach to generate and verify Software Bills of Materials (SBOMs) using semantically meaningful fingerprints of code functionality, enhancing software supply chain security.
Ketchup, Mustard, and Relish of Software Supply Chain Security - Panel Discussion
Explore open source standards and tools for enhancing software supply chain security with industry experts. Learn about S2C2F, SLSA, and FRSCA, their benefits, and how to implement them effectively.
The Impact of Media on Cybersecurity: Using Art to Visualize Software Supply Chain Security Trends
Explore how media influences open source software security through artistic visualization, combining cybersecurity trends with creative techniques to enhance awareness of vulnerabilities.
OmniBOR: Bringing the Receipts for Supply Chain Security
Explore OmniBOR, a new approach to capture full artifact dependency graphs in software development, enhancing supply chain security and addressing SBOM scanner limitations.
Realities of SBOM - What Is Under the Hood of Software Bill of Materials
Explore the complexities of Software Bill of Materials (SBOM) beyond dependency files, including interdependencies, integrity, and vulnerability monitoring across the software development lifecycle.
Security Advisory Programs: Creating Transparency in Software Supply Chain
Strategies for implementing transparent security communications programs in software products, addressing customer demands for vulnerability disclosure and open source patching accountability.
Bringing Provenance to Open Source - Lessons from Npm's Sigstore Integration
Explore npm's integration with Sigstore to enhance package provenance, addressing security challenges and implications for the broader open-source ecosystem.
Toto-Ally TUF: Simple Tools for a Secure Software Supply Chain
Learn to secure software supply chains using in-toto and TUF frameworks. Explore their integration, real-world applications, and new open-source tools for enhanced protection against cyber threats.
Verifying the Validity of Crowd-Sourced Results in Open Source Security - The Scorecard GitHub Action and Sigstore
Explore how the Scorecard GitHub Action ensures security in open-source projects, using Sigstore for result integrity and remote attestation in crowd-sourced data validation.
SLSA in Action: Securing the Software Supply Chain
Live demonstration of securing software supply chain and achieving SLSA compliance using sample repo. OpenSSF SLSA group showcases tooling developed to meet SLSA 1.0 Build Specification, offering practical insights into implementation.
Software Supply Chain Security Case Study at Anaconda
Explore real-world experiences in securing a large-scale open-source packaging pipeline, addressing challenges, implementing solutions, and achieving positive outcomes using respected security designs.
Implementing OpenSSF Best Practices Badges and Scorecards for Project Security
Learn to enhance open-source project security using OpenSSF Best Practices Badges and Scorecards. Gain practical tips for implementation and addressing common issues to improve your project's security posture.
Where Is the GUAC? - Understanding Artifact Composition in Software Supply Chains
Explore GUAC: a tool for comprehensive software supply chain analysis, integrating metadata to identify vulnerabilities, assess trust, and enhance security through GraphQL-powered insights.
Secure Bootloaders and Secure Software Update Support in CIP - Civil Infrastructure Platform
Explore secure bootloaders and software updates in CIP, focusing on implementation, IEC-62443 compliance, and the collaborative efforts of CIP workgroups to enhance industrial software security.