Supply Chain Security, SBOMs and OSPOs: An Ecosystem and Compliance Update
Explore cybersecurity, regulatory compliance, and software supply chain integrity. Learn about SBOMs, the Open Source Security Foundation, and the role of OSPOs in enhancing security.
Maslow's Hierarchy of Supply Chain Needs
Explore Maslow's hierarchy applied to supply chain security, offering insights on prioritizing needs and enhancing overall resilience in the digital ecosystem.
The Supply Chain Conundrum: Why Traditional Application Security Is Failing Us
Explore why traditional app security falls short in protecting against supply chain attacks. Learn proactive, attacker-centric approaches and best practices to safeguard your software development process.
Building SLSA 3 Conformant Attestors for Artifacts Generated on GitHub
Learn to create SLSA 3 compliant attestors for GitHub artifacts, enhancing software supply chain security with minimal effort using recent framework extensions.
Improve Vulnerability Management with OCI Artifacts - It Is That Easy
Learn to enhance vulnerability management using OCI artifacts. Discover how to efficiently utilize SBOMs, signed attestations, and open-source tools for improved supply chain security at scale.
Filling the Gaps in Kubernetes Flavored SLSA with Threat Modeling
Explore threat modeling for Kubernetes CI/CD security using SLSA standards. Learn to identify and mitigate vulnerabilities in supply chain processes, with practical insights from Tekton's implementation.
TUF-En Up Your Signatures - Enhancing Software Distribution Security
Explore The Update Framework (TUF) for enhanced software signing and verification. Learn about its security features, integrations, and new developments for secure software distribution at scale.
Verifiable eBPF Traces for Supply Chain Artifacts with Witness and Tetragon
Explore how Cillium Tetragon and Witness integration simplifies build environment validation and detects tampered tooling, enhancing supply chain security through eBPF traces and build policies.
Securing Open Source Software Supply Chain - Continuous Secure Software Ingestion
Explore secure OSS ingestion in enterprises using Continuous Secure Software Ingestion (CSSI) application, built on Tekton & Open Policy Agent, for automated artifact grooming and policy-driven security checks.
Lessons Learned from Securing 40,000 C++ Packages with Conan.io
Discover how Conan.io maintains zero security incidents while managing 11 million C/C++ binaries. Learn about automated checks, compiler mitigations, and efficient review processes for package security.
Notary: State of Development and Supply Chain Security
Explore supply chain security with Notary project overview, Notary v2 updates, and ecosystem context. Learn about TUF and in-toto projects and their role in achieving security outcomes.
Life of a Sigstore Signature - Understanding Code Signing for Container Images
Explore Sigstore's code signing process for Kubernetes images, including keyless signing, certificate authorities, and transparency logs. Learn to configure admission controllers for cluster security.
Know Your Dependencies - A Guide to Automating Dependency Assurance
Explore automated dependency assurance mechanisms for enhanced visibility into software components, addressing vulnerabilities and license obligations while maintaining development velocity.
Sigstore: Evolution and Future of Software Security Signing
Explore Sigstore's journey in software security signing, its impact on Kubernetes, and future directions. Learn about supply chain security and cutting-edge cryptographic technologies.
SBOM: The Rest of the Story - Understanding Software Bill of Materials
Experts discuss Software Bill of Materials (SBOM), addressing misconceptions, sharing challenges, and exploring implementation strategies for enhanced software supply chain security.
The Software Supply Chain: Challenges and Considerations
Explore the critical aspects and challenges of modern software supply chains in cloud-native environments, focusing on security, efficiency, and best practices.
OmniBOR: Bringing the Receipts for Supply Chain Security
Discover OmniBOR, a revolutionary approach to capture artifact dependency graphs in software development, enhancing supply chain security and reducing false positives in vulnerability scanning.
Securing Diverse Supply Chains Across Interconnected Systems
Explore how SpaceX integrates SBOM and vulnerability discovery tools to enhance security across diverse software systems, reducing response time and improving prioritization for developers.
Untrusted Execution - Attacking the Cloud Native Supply Chain
Explore cloud native supply chain vulnerabilities, threat modeling, and security controls. Learn about trusted execution environments and end-to-end security solutions for protecting complex systems.
Zero Trust Supply Chains with Project Sigstore and SPIFFE
Explore zero trust supply chains using Sigstore and SPIFFE. Learn how to enhance software security through cryptographic verification, transparency logs, and verifiable identities in build systems.
Learning from Supply Chain Failures and Best Practices in Other Industries
Explore supply chain best practices and failures across industries to enhance software supply chain security. Gain insights from physical world processes and apply lessons to critical infrastructure protection.