New Foundations of SBOM Are Underway at OpenSSF
Explore new OpenSSF projects addressing SBOM challenges, including protobom for data handling, sbomit for trust verification, and bomctl for basic operations. Learn about their impact on the SBOM ecosystem.
Securing the Software Supply Chain: An In-Depth Exploration of SLSA
Explore SLSA's impact on software supply chain security, covering fundamentals, trust, transparency, security levels, industry effects, and future trends.
Trials, Tribulations and Triumphs - An End User's Perspective on Software Supply Chain Security
Explore enterprise challenges, initiatives, and future vision for open source software supply chain security from an end user perspective. Learn about threat mitigation strategies and collaborative efforts.
Secure Software Supply Chain Framework (S2C2F) Guide - OpenSSF SIG Meeting
Explore secure open source software consumption practices and improve your software supply chain integrity with the S2C2F guide.
Implementing DevSecOps in Production with Stackrox and Tekton
Implement robust DevSecOps pipelines using Stackrox and Tekton. Eliminate security risks, secure the software supply chain, and provide automated guardrails for developers.
Securing Python Projects Supply Chain
Explore best practices and tools for securing Python projects' supply chain, from development to distribution. Learn about cryptographic signatures, SBOMs, and SLSA attestations.
Five and a Half Actions to Mitigate Software Supply Chain Threats
Discover five crucial actions to protect your software supply chain from threats, including insights from Commerzbank's use of Google Cloud's Assured OSS.
SLSA: Enhancing Software Supply Chain Security - More Than Just a Garnish for Your Pipelines
Explore SLSA principles for securing software supply chains. Learn threat models, security levels, and how to contribute to this OpenSSF project for enhanced DevSecOps processes.
Software Supply Chain Security - Key Terms, Players, and Projects - Part 2
Explore key terms, players, and projects in software supply chain security. Gain insights on open-source visibility, SBOMs, and initiatives addressing complex security challenges in the open-source pipeline.
Tackling Software Supply Chain Security as an Organization - Episode 128
Explore organizational approaches to software supply chain security with experts discussing solutions, initiatives, and best practices for managing risks and improving visibility.
Software Supply Chain Security: Definition and Importance - Episode 1
Explore the key pillars of software supply chain security in this comprehensive podcast episode. Gain insights into problem definition, essential terms, and practical implementation strategies for enhancing your organization's security posture.
Why You Can Still Get Hacked Even After Signing Your Software Artifacts
Explore artifact poisoning tactics in software supply chains and learn prevention methods, including secure artifact signing, to protect your CI/CD pipeline from malicious injections.
Securing Software Supply Chains Using the SLSA Framework
Implement SLSA framework to secure software supply chains. Learn practical, vendor-neutral examples for code, build process, provenance, and deployment to create a resilient software development lifecycle.
Let Devs Be Devs Without Sacrificing Security
Explore flexible, secure CI pipelines using Tekton, Chains, and Enterprise Contract to balance developer innovation with robust security measures for various software targets.
Exploring a Risk Approach to Software Supply Chain Security
Explore software supply chain security through a risk-based approach, focusing on open source vulnerabilities and process improvements to mitigate supplier risks.
SBOMs: Zero to Hero - A Comprehensive Guide
Discover SBOMs: definition, importance, contents, creation methods, and open-source tools. Explore integration challenges and solutions in build processes.
SLSA - A Supply Chain Security Framework
Explore SLSA framework for securing software supply chains, mitigating vulnerabilities, and ensuring code integrity from development to deployment.
DevSecOps by Default: Lessons from Log4Shell - What We Have, Can, and Must Learn
Explore DevSecOps strategies post-Log4Shell, focusing on strengthening software supply chains, vulnerability detection, and implementing "Secure by Default" policies using open-source tools.
The Current Situation of SBOM in Japan
Explore Japan's SBOM adoption progress, including METI guidelines, implementation challenges, and the evolving landscape of software supply chain security in Japanese companies.
Becoming a Link in Securing the Software Supply Chain
Explore open source security fundamentals, challenges, and opportunities. Learn how to contribute to existing communities and play a role in securing the software supply chain ecosystem.
Securing the Software Supply Chain - Beyond SBOM Risk Assessment
Explore advanced software supply chain security strategies, focusing on risk assessment, contributor profiles, project dynamics, and integrating security into deployment pipelines.