Securing Diverse Supply Chains Across Interconnected Systems
Explore how SpaceX integrates SBOM and vulnerability discovery tools to enhance security across diverse software systems, reducing response time and improving prioritization for developers.
SLSA FRSCA Recipe for Secure Supply Chain
Explore an end-to-end solution for software supply chain security using OpenSSF-FRSCA, integrating tools like Tekton, Sigstore, and Kyverno to meet SLSA Level 3 requirements.
Untrusted Execution - Attacking the Cloud Native Supply Chain
Explore cloud native supply chain vulnerabilities, threat modeling, and security controls. Learn about trusted execution environments and end-to-end security solutions for protecting complex systems.
Zero Trust Supply Chains with Project Sigstore and SPIFFE
Explore zero trust supply chains using Sigstore and SPIFFE. Learn how to enhance software security through cryptographic verification, transparency logs, and verifiable identities in build systems.
Sharing Security Secrets: How to Encourage Security Advocates
Discover strategies for fostering a company-wide security culture, educating non-security teams, and implementing a successful security advocates program to enhance organizational data protection and service availability.
Learning from Supply Chain Failures and Best Practices in Other Industries
Explore supply chain best practices and failures across industries to enhance software supply chain security. Gain insights from physical world processes and apply lessons to critical infrastructure protection.
Verifying Software Signatures with TUF and Sigstore
Explore secure software verification using TUF and Sigstore. Learn to design effective verification policies, understand signing limitations, and enhance security for open-source repositories and container registries.
Leveraging SBOMs to Automate Packaging, Transfer, and Reporting of Dependencies Between Secure Environments
Explore innovative uses of Software Bill of Materials (SBOMs) for secure asset transfer, dependency management, and cloud-native infrastructure deployments using CycloneDX and open-source tools.
Security Threat Modeling Live from Scratch Session
Hands-on workshop demonstrating lightweight threat modeling for CNCF projects, led by Andrew Martin. Learn practical techniques to identify and mitigate security risks in cloud-native environments.
Security That Enables - Breaking Down Security Silos in the DevOps Ecosystem
Explore strategies to integrate security seamlessly into DevOps, addressing challenges in CI/CD workflows and learning from real-world breaches to enable confident, secure deployments.
Digital Forensics and Incident Response in Containerized Environments
Explore Digital Forensics and Incident Response (DFIR) techniques for containerized applications, focusing on Kubernetes. Learn best practices for evidence collection and incident containment in modern cloud environments.
So You Want to Run Your Own Sigstore - Recommendations for a Secure Setup
Explore secure setups for private Sigstore instances, covering motivations, threat modeling, and operational requirements for enterprise artifact signing and verification.
How to Trust Your Open Source Software Using Scorecards
Explore OSSF Scorecards to assess open source software health, automate risk evaluation, and build dependency policies for informed decision-making in software development.
How to Secure Your Supply Chain at Scale
Learn how Yahoo secures its software supply chain using open-source tools like Grafeas, Sigstore, and Kyverno. Discover strategies for source code scanning, vulnerability management, and protecting Kubernetes deployments at scale.
How do Mature DevOps Teams Manage Software Security?
Explore strategies for managing software security in mature DevOps environments, focusing on best practices and innovative approaches for integrating security into the development lifecycle.
A Holistic Approach to Managing Cyber Assets and Extending Security Posture
Explore holistic cyber asset management and enhance your security posture in this insightful presentation on modern cybersecurity strategies.
SBOMs, VEX, and Kubernetes - Software Supply Chain Security in Cloud Native Environments
Explore software supply chain security with experts discussing SBOMs, VEX, and their practical applications in Kubernetes environments, from open-source projects to regulated industries.
Handling JWTs: Understanding Common Pitfalls
Explore JWT authentication, common pitfalls, and security best practices. Learn about JWT structure, verification, and protection against attacks like algorithm confusion and secret brute-forcing.
Keyless Code Signing Without Fulcio
Explore keyless code signing without Fulcio, understanding its benefits and implementing it with existing PKI solutions like Vault and stepca for hassle-free, secure software signing.
Growing SPIFFE and SPIRE in 2023 and Beyond - Secure Identity Management Progress
Explore SPIFFE/SPIRE's latest advancements in secure identity management, including Windows support, SIGSTORE integration, and enhanced hardware security, empowering enterprises with robust infrastructure protection.
Secure Your Project with the SIG Release Supply Chain Kit
Explore tools for enhancing supply chain security in open-source projects, including SBOMs, signed attestations, and secure release pages. Learn how to implement these features using reusable GitHub actions.