PEP 458 - A Solution Not Only for PyPI
Explore PEP 458's cryptographic signing for PyPI and its broader applications in securing software supply chains, including the Repository Service for TUF project and its potential benefits.
In-toto - Securing the Entire Software Supply Chain
Explore in-toto's protocol for verifiably defining and securing software supply chain steps, enhancing security guarantees for cloud-native and other ecosystems.
Understanding, Maintaining and Securing Envoy's Supply Chain
Explore Envoy's software supply chain, focusing on security, dependencies, and maintenance strategies. Learn to minimize risks and increase confidence in third-party components.
Protecting Ourselves from CNCFgate - Software Supply Chain Security at CNCF - Practices, and Tools
Explore cloud-native software supply chain security practices, challenges, and tools. Learn strategies to protect against vulnerabilities and attacks in complex software systems.
Hardening the Kubernetes Software Supply Chain Through Better Transparency
Explore Kubernetes software supply chain hardening through transparency, covering SPDX Bill of Materials, artifact verification, and digital signing. Learn about SIG Release tools for community use.
Cloud Native Supply Chain Security with Tekton and Sigstore
Hands-on overview of creating a secure zero-trust supply chain on Kubernetes using Tekton, Tekton Chains, and sigstore. Learn to protect pipelines, generate provenance, and integrate with In-Toto and SPIRE.
Whose Sign Is It Anyway?
Explore digital signatures' true meaning, implications of key handling policies, and identity concepts in software supply chain security. Dive deep into cryptographic realities and case studies.
State of the Art Supply Chain Security - In-toto, TUF, and SigStore
Explore cutting-edge supply chain security with in-toto, TUF, and SigStore. Learn how these tools create a transparent, hack-proof system to protect software from developer to end-user.
An Overview on SLSA
Explore SLSA methodology for preventing software supply chain tampering, illustrated through gremlin scenarios and demonstrating how SLSA controls raise attack costs and ensure security.
We Built the Kubernetes SBOM and Now You Can Write Your Own
Explore Kubernetes SBOM creation, its role in software supply chain, and SPDX standard. Learn to build your own SBOM using available tools through a live demo and practical insights.
Beyond Kubernetes Security
Explore advanced Kubernetes security practices, including common and sophisticated attacks, defense strategies, and leveraging Kubernetes to enhance overall security posture and address supply chain issues.
Project Copacetic - Directly Patch Container Image Vulnerabilities
Discover how to efficiently patch container image vulnerabilities with Project Copacetic, streamlining security updates through automated scanning, direct patching, and seamless pipeline integration.
Continuous Assurance of Supply Chain Security Levels of Open Source Artifacts Using SLSA 0.1
Discover how to verify SLSA provenance in trusted build systems to enhance supply chain security and protect against modified sources, compromised builds, and package tampering.
Navigating the Open Source Policy Labyrinth: Unraveling Global Policy Efforts for a Secure Future
Explore global policy initiatives shaping open-source software security, from US Executive Orders to EU regulations, while understanding how modern frameworks like SLSA and Software Self Attestation enhance digital infrastructure.
Meeting the OpenSSF Security Baseline with Minder
Discover how Minder platform helps monitor and ensure OpenSSF Security Baseline compliance across repositories, with practical demonstrations of automated security posture management.
End-to-End Secure Machine Learning Development - Building a Secure AI Supply Chain
Discover essential security practices for AI development, from dataset handling to production deployment, focusing on supply chain security, model provenance, and risk mitigation in machine learning applications.
Secure Code, Safe Future: Mastering Security in Critical Software Development
Discover practical secure coding techniques and strategies for developing robust software, including vulnerability management, SBOM implementation, and hands-on security practices for critical infrastructure projects.
Securing the Unseen: Defending Against Open Source Software Supply Chain Attacks
Discover practical strategies to protect applications from supply chain attacks targeting open source dependencies, with real examples and actionable defense measures.
Fast, Correct, Secure - Building Reliable and Secure Software with Bazel
Explore advanced Bazel features for building secure, fast, and correct software at scale, including SBOM generation, audit trails, and achieving SLSA compliance in development pipelines.
Software Supply Chain Security - Transforming Challenges into Improved Open Source Software
Discover practical strategies for navigating software supply chain security challenges through community-driven approaches and developer empowerment in the open-source ecosystem.
Understanding Software Component Analysis (SCA) in Plain Language
Gain insights into software supply chain security concepts like SBOM, VEX, and SLSA, demystifying their importance for protecting organizational assets and code integrity.