Every Journey to Securing the Software Supply Chain Starts with a Single Step
Explore NYU's journey in software supply chain security, uncovering challenges, best practices, and a roadmap for enhancing software security.
Eating the Open Source Security Sandwich with Skootrs
Explore Skootrs, an open-source tool simplifying adoption of security practices for software developers through automation and guardrails.
Build Provenance: Lessons from Homebrew
Explore build provenance for Homebrew package manager, including achievements, challenges, and technical insights. Learn about its architecture and implications for similar ecosystems.
A Beginner's View of Public Instances
Explore OpenSSF's public instances: hosting, scale, security, and usage guidelines. Gain insights into tools for safer software development and protection against attackers.
Presenting the OSTIF Independent Security Audit Impact Report
Explore OSTIF's 2022 security improvements to critical open source projects, funded by OpenSSF. Learn about the initiative's background and key outcomes.
Getting Involved in Sigstore Research Projects
Explore Sigstore's research opportunities in privacy-conscious transparency, stronger verification assurances, and distributed trust timestamping. Learn how to contribute to this open-source project.
SLSA: A Security Paradigm for Software Supply Chain Integrity
Explore SLSA levels, software supply chain security basics, and tools like Cosign to enhance artifact integrity and benefit your organization.
Proactive Supply Chain Security with GUAC
Explore GUAC, a tool for proactive software supply chain security. Learn about its features, recent release, roadmap, and how to contribute to this OpenSSF project.
Improving Posture of Critical OSS Projects with Security Audits
Explore effective security audits for open source projects, including top vulnerabilities, lessons learned, and common mistakes to avoid. Enhance your OSS security posture.
Practical Steps for Securing the Entire SDLC
Practical steps for securing the entire software development lifecycle, moving beyond secure coding to embrace holistic system security throughout the development process.
Keynote - Consumer Protection in the Age of AI
Explore insights from Stephanie Nguyen of the U.S. Federal Trade Commission on critical issues at the intersection of technology, fairness, accountability, and transparency in this keynote address.
Navigating the Intersection: AI's Role in Shaping the Secure Open Source Software Ecosystem
Explore AI's impact on open-source software security, covering OSS in AI systems, open-sourcing AI components, AI-driven security automation, and AI's evolving role in OSS development.
API Security: Code-to-Cloud Context for Complete Protection
Comprehensive approach to API security, covering code-level inventorying and runtime protection. Learn to mitigate issues faster and improve organizational API security posture efficiently.
Using Large Language Models to Improve Data Loss Prevention in Organizations
Explore how large language models enhance data loss prevention by enabling full-text analysis and document categorization, improving sensitive information detection beyond pattern-based matching.
Navigating the Quantum Readiness Journey: Securing Kubernetes with Quantum-Resistant Cryptography
Explore quantum-resistant cryptography for Kubernetes security. Hands-on insights into mTLS, x.509 certs, and container signing. Learn standardization progress and empower yourself to conduct tailored experiments.
Security as a Culture: The Distributed Advocacy Approach
Explore distributed advocacy in cybersecurity, integrating security into development processes. Learn how to foster collaboration between security advocates and developers for enhanced system protection.
Leveraging the Linux Kernel for Building a Zero-Trust Environment Without a Service Mesh
Explore an innovative approach to zero-trust security using a Linux kernel module for mTLS and access control, avoiding service mesh complexities while maintaining strong workload identities and traffic encryption.
CVE Context Matters - Prioritizing Vulnerabilities in Cloud-Native Projects
Explore vulnerability scanning in cloud-native projects, learn to prioritize vulnerabilities, and implement effective scanners. Gain insights on assessing relevance and improving daily workflows.
Evasive Maneuvers - Strategies to Overcome Runtime Detection Tools
Explore innovative evasion strategies against runtime detection tools, from obfuscation to behavioral camouflage. Gain insights into evolving threat actor tactics and the importance of adaptive security measures.
ShellTorch - The Next Evolution in *4Shell Executions
Uncover ShellTorch vulnerabilities in TorchServe, enabling remote code execution and AI model manipulation. Learn about the high-severity exploit's impact on PyTorch ecosystem and essential mitigation strategies.
Future Open Source LLM Kill Chains - Security Risks and Mitigation Strategies
Explore potential security risks in open-source AI ecosystems, focusing on LLM vulnerabilities and kill chains. Learn mitigation strategies to protect against sophisticated adversaries in the evolving AI landscape.