Securing the Supply Chain: A Practical Guide to SLSA Compliance from Build to Runtime
Dive into SLSA compliance for supply chain security using CNCF tools. Explore GitHub Actions, Cosign, Kyverno, in-toto, and Kubescape to secure software from build to runtime in Kubernetes ecosystems.
In-Toto: Protecting Software Supply Chain in Cloud Native and Confidential Containers
探讨In-toto项目如何保护软件供应链完整性,以及在Confidential Containers等云原生应用中的应用,展示其在提供可信元数据和验证供应链步骤方面的优势。
Toto-Ally TUF: Simple Tools for a Secure Software Supply Chain
Learn to secure software supply chains using in-toto and TUF frameworks. Explore their integration, real-world applications, and new open-source tools for enhanced protection against cyber threats.
Software Supply Chain Security Case Study at Anaconda
Explore real-world experiences in securing a large-scale open-source packaging pipeline, addressing challenges, implementing solutions, and achieving positive outcomes using respected security designs.
Notary: State of Development and Supply Chain Security
Explore supply chain security with Notary project overview, Notary v2 updates, and ecosystem context. Learn about TUF and in-toto projects and their role in achieving security outcomes.
Achieving End-to-End Software Supply Chain Security with in-toto
Explore in-toto's advancements in software supply chain security, including artifact tracking, attestation types, and integrations with CNCF projects for cloud-native identity protection.
Verifying Software Signatures with TUF and Sigstore
Explore secure software verification using TUF and Sigstore. Learn to design effective verification policies, understand signing limitations, and enhance security for open-source repositories and container registries.
In-Toto: Attestations and Software Supply Chain Security
Explore in-toto framework's advancements in software supply chain security, including attestation verification, type mapping, and integrations with CNCF projects and industry tools.
Securing Your Container Native Supply Chain with SLSA, GitHub and Tekton
Practical guide to securing container native supply chains using SLSA principles, in-toto attestations, and step-by-step demos for achieving SLSA Level 2 in Tekton and Github Actions.
Enforcing Supply Chain Security and Simplifying Compliance Audit for ArgoCD Deployments
Explore techniques for securing supply chains and simplifying compliance audits in ArgoCD deployments using open-source tools like Guac, Sigstore, and in-toto.
Securing the Supply Chain: A Practical Guide to SLSA Compliance from Build to Runtime
Practical guide to securing software supply chain using CNCF tools. Covers SLSA compliance, GitHub Actions, Cosign, Kyverno, in-toto, and Kubescape for build-to-runtime security in Kubernetes ecosystems.
The Road to Zero CVEs: People and Technology
Explore open source software vulnerabilities, supply chain security legislation, and emerging tools like Sigstore to fortify digital ecosystems and manage CVEs effectively.
Navigating the Software Supply Chain Defense Landscape
Explore software supply chain security tools and frameworks, their integration, and how to select the right combination for comprehensive protection against rising cyber threats.
Protect the Pipe - A Policy-based Approach for Securing CI/CD Pipelines
Explore a cloud-native security framework for CI/CD pipelines using in-toto, Kyverno, and sigstore. Learn to implement policy-based controls and address unique security challenges in modern application delivery.
Cloud Native Supply Chain Security: Beyond SBOMs - Perspectives and Practices
Insights on cloud native supply chain security beyond SBOMs. Experts discuss straightforward approaches, simple security practices, and future perspectives using open-source tools and frameworks.
Container Security: Supply Chain, Authorization, and Runtime Protection
Explore container security: supply chain integrity, deployment authorization, and runtime protection. Experts discuss in-toto, TUF, Open Policy Agent, and container escape prevention.
Securing Your Infrastructure as Code Pipeline
Explore techniques for securing Infrastructure as Code pipelines, including static analysis, RBAC, and open-source tools like Open Policy Agent and Sigstore, to enhance productivity and compliance.
Kubernetes Supply Chain Security - Building a Secure Software Factory
Explore Kubernetes supply chain security, software factory approaches, and defense strategies against attacks. Learn about signing, verification, and lessons from SUNBURST to enhance cloud-native security.
Demystify Modern Signing: Keys, Certificates, and Envelopes
Explore practical aspects of cryptographic signing tools, covering key algorithms, signing envelopes, certificates, and verification, with a focus on identity-based signing using short-lived keys.
Securing the Software Supply Chain with the In-toto and SPIRE Projects
Explore securing software supply chains using in-toto and SPIRE projects. Learn about cryptographic attestation, automated certificate issuance, and building trust in software releases.
In-toto - Securing the Entire Software Supply Chain
Explore in-toto's protocol for verifiably defining and securing software supply chain steps, enhancing security guarantees for cloud-native and other ecosystems.