Trust No System: The Unsettling Reality of Zero Trust
Challenging "Zero Trust" in cloud-native security, this talk explores trust as an observer's decision, debunks myths, and offers strategies for managing trust in cloud environments.
TUF-En Up Your Signatures - Enhancing Software Distribution Security
Explore The Update Framework (TUF) for enhanced software signing and verification. Learn about its security features, integrations, and new developments for secure software distribution at scale.
No Keys? No Problem - Why You Can Trust Sigstore Signatures
Explore Sigstore's keyless code signing, its security measures, and trust mechanisms. Learn how it protects software supply chains using open principles and robust infrastructure.
Notary: State of Development and Supply Chain Security
Explore supply chain security with Notary project overview, Notary v2 updates, and ecosystem context. Learn about TUF and in-toto projects and their role in achieving security outcomes.
Achieving End-to-End Software Supply Chain Security with in-toto
Explore in-toto's advancements in software supply chain security, including artifact tracking, attestation types, and integrations with CNCF projects for cloud-native identity protection.
Building Sigstore Policies from Scratch
Learn to create and implement Sigstore policies for secure software supply chains, enhancing your project's integrity and trust in the cloud-native ecosystem.
Life of a Sigstore Signature - Understanding Code Signing for Container Images
Explore Sigstore's code signing process for Kubernetes images, including keyless signing, certificate authorities, and transparency logs. Learn to configure admission controllers for cluster security.
Sigstore for Python Packaging - Next Steps for Adoption
Explore Sigstore integration in Python packaging, its benefits for users, and strategies for adoption. Learn about enhancing security in package publishing and consumption workflows.
The Road to SLSA4 - Applying the Sigstore Ecosystem in a Corporate Environment
Explore Sigstore ecosystem implementation for software artifact integrity, covering self-hosting, keyless signatures, OIDC tokens, and verification methodologies in various environments.
Know Your Dependencies - A Guide to Automating Dependency Assurance
Explore automated dependency assurance mechanisms for enhanced visibility into software components, addressing vulnerabilities and license obligations while maintaining development velocity.
Sigstore: Evolution and Future of Software Security Signing
Explore Sigstore's journey in software security signing, its impact on Kubernetes, and future directions. Learn about supply chain security and cutting-edge cryptographic technologies.
Securing Content Repositories with The Update Framework (TUF)
Explore secure content delivery using The Update Framework (TUF). Learn about protecting repositories, managing keys, and recovering from compromises. Discover recent developments and implementation updates.
OmniBOR: Bringing the Receipts for Supply Chain Security
Discover OmniBOR, a revolutionary approach to capture artifact dependency graphs in software development, enhancing supply chain security and reducing false positives in vulnerability scanning.
SLSA FRSCA Recipe for Secure Supply Chain
Explore an end-to-end solution for software supply chain security using OpenSSF-FRSCA, integrating tools like Tekton, Sigstore, and Kyverno to meet SLSA Level 3 requirements.
Verifying Software Signatures with TUF and Sigstore
Explore secure software verification using TUF and Sigstore. Learn to design effective verification policies, understand signing limitations, and enhance security for open-source repositories and container registries.
So You Want to Run Your Own Sigstore - Recommendations for a Secure Setup
Explore secure setups for private Sigstore instances, covering motivations, threat modeling, and operational requirements for enterprise artifact signing and verification.
How to Trust Your Open Source Software Using Scorecards
Explore OSSF Scorecards to assess open source software health, automate risk evaluation, and build dependency policies for informed decision-making in software development.
How to Secure Your Supply Chain at Scale
Learn how Yahoo secures its software supply chain using open-source tools like Grafeas, Sigstore, and Kyverno. Discover strategies for source code scanning, vulnerability management, and protecting Kubernetes deployments at scale.
How do Mature DevOps Teams Manage Software Security?
Explore strategies for managing software security in mature DevOps environments, focusing on best practices and innovative approaches for integrating security into the development lifecycle.
Keyless Code Signing Without Fulcio
Explore keyless code signing without Fulcio, understanding its benefits and implementing it with existing PKI solutions like Vault and stepca for hassle-free, secure software signing.
Growing SPIFFE and SPIRE in 2023 and Beyond - Secure Identity Management Progress
Explore SPIFFE/SPIRE's latest advancements in secure identity management, including Windows support, SIGSTORE integration, and enhanced hardware security, empowering enterprises with robust infrastructure protection.