SLSA in Action: Securing the Software Supply Chain
Live demonstration of securing software supply chain and achieving SLSA compliance using sample repo. OpenSSF SLSA group showcases tooling developed to meet SLSA 1.0 Build Specification, offering practical insights into implementation.
Software Supply Chain Security Case Study at Anaconda
Explore real-world experiences in securing a large-scale open-source packaging pipeline, addressing challenges, implementing solutions, and achieving positive outcomes using respected security designs.
Where Is the GUAC? - Understanding Artifact Composition in Software Supply Chains
Explore GUAC: a tool for comprehensive software supply chain analysis, integrating metadata to identify vulnerabilities, assess trust, and enhance security through GraphQL-powered insights.
Securing the Software Supply Chain: From Threats to Best Practices
Comprehensive overview of software supply chain security, covering history, threats, initiatives, challenges, and best practices. Experts discuss key issues and solutions for organizations.
Improving Global Software Supply Chain Security with Alpha-Omega Project
Explore strategies to enhance global software supply chain security through the Alpha-Omega Project, focusing on critical and long-tail open source projects.
VEX Overview - Cybersecurity and Infrastructure Security Agency
Explore VEX with cybersecurity expert Allan Friedman, gaining insights into this crucial aspect of infrastructure security and its implications for modern digital systems.
Lessons Learned from Automating SLSA-Compliance Evaluation
Explore automating SLSA-compliance evaluation, covering provenance, pipeline dynamics, and challenges in implementing various SLSA levels. Gain insights on evidence-based trust and unfalsifiable provenance.
Google SLSA and NIST SSDF - Emerging Software Supply Chain Security Best Practices
Explore emerging best practices for software supply chain security, focusing on Google's SLSA framework and NIST's SSDF guidelines to enhance your organization's cybersecurity posture.
What Role Do Package Registries Have in Securing the Supply Chain?
Explore the critical role of package registries in supply chain security, focusing on their impact, challenges, and best practices for enhancing software integrity and reliability.
Road to SLSA3 - Non-falsifiable Provenance in Tekton with SPIFFE/SPIRE
Explore non-falsifiable provenance in Tekton using SPIFFE/SPIRE, enhancing software supply chain security and achieving SLSA3 compliance.
GitBOM - Repurposing Git's Graph for Supply Chain Security and Transparency
Explore innovative use of Git's graph structure for enhancing software supply chain security and transparency, offering insights into modern cybersecurity practices.
Software Supply Chain Threat Landscapes - A Moving Target
Explore evolving software supply chain threats and learn strategies to protect your organization from vulnerabilities, malicious attacks, and emerging risks in the digital ecosystem.
Maintaining The Update Framework (TUF) - Insights and Contributions
Insights into maintaining The Update Framework (TUF) for secure content delivery, covering organization, implementation, and community involvement in software supply chain security.
Building SLSA 3 Conformant Attestors for Artifacts Generated on GitHub
Learn to create SLSA 3 compliant attestors for GitHub artifacts, enhancing software supply chain security with minimal effort using recent framework extensions.
Fight Back Against Cyber Risk in the Software Supply Chain - Secure DevSecOps Pipeline for Regulated Environments
Secure DevSecOps pipelines for regulated environments: best practices, open-source tools, and real-world application in banking using BIAN framework and technologies like Tekton, Terraform, and SonarQube.
Filling the Gaps in Kubernetes Flavored SLSA with Threat Modeling
Explore threat modeling for Kubernetes CI/CD security using SLSA standards. Learn to identify and mitigate vulnerabilities in supply chain processes, with practical insights from Tekton's implementation.
What Data Tells Us About Software Supply Chain Security and What To Do About It
Experts analyze data from surveys and reports on cloud-native and open source software security, providing actionable insights to improve software supply chain security for organizations and projects.
No Keys? No Problem - Why You Can Trust Sigstore Signatures
Explore Sigstore's keyless code signing, its security measures, and trust mechanisms. Learn how it protects software supply chains using open principles and robust infrastructure.
Notary: State of Development and Supply Chain Security
Explore supply chain security with Notary project overview, Notary v2 updates, and ecosystem context. Learn about TUF and in-toto projects and their role in achieving security outcomes.
Achieving End-to-End Software Supply Chain Security with in-toto
Explore in-toto's advancements in software supply chain security, including artifact tracking, attestation types, and integrations with CNCF projects for cloud-native identity protection.
Supply Chain Security: Building a Knowledge Graph for Artifact Relationships
Explore a supply chain knowledge graph tool that enhances understanding of artifact relationships, enabling better assessment of vulnerabilities and dependencies in software development.