Verifiable eBPF Traces for Supply Chain Artifacts with Witness and Tetragon
Explore how Cillium Tetragon and Witness integration simplifies build environment validation and detects tampered tooling, enhancing supply chain security through eBPF traces and build policies.
Securing Open Source Software Supply Chain - Continuous Secure Software Ingestion
Explore secure OSS ingestion in enterprises using Continuous Secure Software Ingestion (CSSI) application, built on Tekton & Open Policy Agent, for automated artifact grooming and policy-driven security checks.
Lessons Learned from Securing 40,000 C++ Packages with Conan.io
Discover how Conan.io maintains zero security incidents while managing 11 million C/C++ binaries. Learn about automated checks, compiler mitigations, and efficient review processes for package security.
Why Machines Deserve Rights - Rethinking Automated Infrastructure Access with OSS Teleport Machine ID
Explore identity-based access control for machines in modern infrastructure. Learn about Teleport Machine ID for secure, auditable, and efficient automated access to cloud resources.
Secure CI/CD Using JSON Web Token (JWT)
Explore how GitLab leverages JWT for secure access to secret management solutions, enhancing DevSecOps practices and addressing challenges in retrieving sensitive data across cloud providers.
Fileless Attack - Detecting the Undetectable
Explore fileless attacks in Linux containers, their detection using eBPF tools like Falco, Tracee, and Tetragon, and learn to identify unexpected activities in cloud-native environments.
No Keys? No Problem - Why You Can Trust Sigstore Signatures
Explore Sigstore's keyless code signing, its security measures, and trust mechanisms. Learn how it protects software supply chains using open principles and robust infrastructure.
Hack Back: Learning Security with Capture-The-Flag Events
Explore state-of-art Kubernetes attack scenarios and defense strategies through Capture-The-Flag exercises. Learn to improve your organization's security using open-source tools like Simulator and Tetragon.
Notary: State of Development and Supply Chain Security
Explore supply chain security with Notary project overview, Notary v2 updates, and ecosystem context. Learn about TUF and in-toto projects and their role in achieving security outcomes.
Supply Chain Security: Building a Knowledge Graph for Artifact Relationships
Explore a supply chain knowledge graph tool that enhances understanding of artifact relationships, enabling better assessment of vulnerabilities and dependencies in software development.
Sigstore for Python Packaging - Next Steps for Adoption
Explore Sigstore integration in Python packaging, its benefits for users, and strategies for adoption. Learn about enhancing security in package publishing and consumption workflows.
The Road to SLSA4 - Applying the Sigstore Ecosystem in a Corporate Environment
Explore Sigstore ecosystem implementation for software artifact integrity, covering self-hosting, keyless signatures, OIDC tokens, and verification methodologies in various environments.
SBOM is Coming - Why You Should Care and How You Can Help
Explore the importance of Software Bill of Materials (SBOM) in cloud-native ecosystems, its impact on security, and how you can contribute to its implementation and adoption.
Sigstore: Evolution and Future of Software Security Signing
Explore Sigstore's journey in software security signing, its impact on Kubernetes, and future directions. Learn about supply chain security and cutting-edge cryptographic technologies.
SLSA with Cosign and Kyverno - Securing Software Delivery in Cloud Native Environments
Explore SLSA, Cosign, and Kyverno for enhancing software delivery security in cloud-native environments. Learn practical techniques to safeguard your development pipeline.
Keeping Up with CVEs: Finding Needles in Haystacks - Practical Vulnerability Assessment
Discover practical approaches to assess product security beyond raw vulnerability numbers, focusing on risk assessment and understanding scanner limitations in container image analysis.
SBOM: The Rest of the Story - Understanding Software Bill of Materials
Experts discuss Software Bill of Materials (SBOM), addressing misconceptions, sharing challenges, and exploring implementation strategies for enhanced software supply chain security.
Change is Hard - Securing the Future Today
Explore the socio-technical challenges of implementing modern security practices, blending research and anecdotes to address resistance to change and holistic problem-solving approaches.
Cryptographic Signatures - A Building Block Not A Panacea
Explore cryptographic signatures in software supply chain security, their benefits, limitations, and effective implementation strategies for cloud-native applications.
SPIFFE: In Theory and Practice - Deep Dive and Q&A
Explore SPIFFE's vision, components, and role in cloud-native environments. Learn about the SPIFFE specification, IDs, naming, and trust domains in this informative deep dive with Q&A.
Shifting Security Left - Simplifying Security for Kubernetes and OpenShift Environments
Learn to simplify security in Kubernetes and OpenShift, focusing on authentication, secrets management, and bridging the gap between security and DevOps for more efficient cloud-native environments.