The Road to Zero CVEs: People and Technology
Explore open source software vulnerabilities, supply chain security legislation, and emerging tools like Sigstore to fortify digital ecosystems and manage CVEs effectively.
Eliminating the Unknowns: Using GUAC to Better Understand Your Software Supply Chain
Learn how GUAC, an open-source knowledge graph, aggregates software supply chain metadata to enhance security, inform decision-making, and enable policy-driven admission control in your development lifecycle.
The Evolution of SBOMs in AlmaLinux
Explore AlmaLinux's SBOM generation process, its evolution to meet NTIA requirements, and the implications for RPM-based Linux distributions. Learn about challenges and solutions in software supply chain security.
Software Supply Chain Security with Trusted Execution Environment Provisioning Protocol
Explore TEEP protocol for secure software supply chain management, covering its benefits, implementation, and application across various hardware platforms and industries.
Beyond Guidelines - Designing and Implementing Robust Build Pipelines
Learn to design and implement secure build pipelines beyond standard guidelines. Explore practical tools and methods to enhance supply chain security and protect against rising attacks.
Open Software Supply Chain Attack Reference (OSC&R) - OWASP Foundation
Explore the OSC&R framework for software supply chain security, analyzing real-world attacks and improving DevSecOps programs to enhance overall security posture.
Navigating the Software Supply Chain Defense Landscape
Explore software supply chain security tools and frameworks, their integration, and how to select the right combination for comprehensive protection against rising cyber threats.
GUAC 101 - Introduction to Graph for Understanding Artifact Composition
Explore GUAC, a tool for generating software bills of materials (SBOMs) and vulnerability scanning in cloud-native environments, enhancing security and compliance.
Improving Global Software Supply Chain Security with Alpha-Omega
Explore the Alpha-Omega Project's framework for enhancing software supply chain security, focusing on critical and long-tail open source projects. Gain insights into this new OpenSSF initiative.
Leveraging Sigstore Capabilities in a Local Environment
Explore Lockheed Martin's integration of Sigstore for secure, auditable software development. Learn about internal Kubernetes deployments, certificate authorities, and streamlined GitLab pipelines for enhanced security.
Born of Hard Times - The Clean Dependency Project is Here to Help
Explore the Clean Dependency Project's proactive approach to OSS vulnerability management and learn how to contribute to this innovative open-source initiative.
Sigstore: Using Transparent Digital Signatures to Help Secure the Software Supply Chain
Explore transparent digital signatures with Sigstore to enhance software supply chain security. Learn key techniques for protecting open source ecosystems.
Building and Using the OpenSSF Security Toolbelt - 6 Months In
Explore the OpenSSF Security Toolbelt initiative: its mission, progress, and impact on open-source security. Learn about tools, patterns, and opportunities to enhance software supply chain protection.
Fresh SLSA and GUAC - Understanding Open Source Package Risks and Transparency
Explore open source package risks, transparency, and tools like GUAC, SLSA, and SBOMs to enhance software supply chain security and make informed decisions on dependencies.
Open-Source Vulnerability Management: Use the Source - DevSecOps 2022
Explore open-source vulnerability management techniques using source code analysis for effective security practices in DevSecOps environments.
There's Somebody in My Package Manager - Security Risks and Mitigation
Explore package manager security risks and learn strategies to protect against supply chain attacks in software development.
Every Journey to Securing the Software Supply Chain Starts with a Single Step
Explore NYU's journey in software supply chain security, uncovering challenges, best practices, and a roadmap for enhancing software security.
Eating the Open Source Security Sandwich with Skootrs
Explore Skootrs, an open-source tool simplifying adoption of security practices for software developers through automation and guardrails.
Getting Involved in Sigstore Research Projects
Explore Sigstore's research opportunities in privacy-conscious transparency, stronger verification assurances, and distributed trust timestamping. Learn how to contribute to this open-source project.
SLSA: A Security Paradigm for Software Supply Chain Integrity
Explore SLSA levels, software supply chain security basics, and tools like Cosign to enhance artifact integrity and benefit your organization.
Proactive Supply Chain Security with GUAC
Explore GUAC, a tool for proactive software supply chain security. Learn about its features, recent release, roadmap, and how to contribute to this OpenSSF project.