How Secure Is Your Build/Server?
Talkat Cloud Native Security Day Europe 2020 · on Monday, 2020-08-17· at 16:05· InXpo, https://onlinexperiences.com/Launch/Event.htm?ShowKey=99259·
summary
Starts from laptop trust (OS, CA roots, OpenSSL ciphers) and walks the build chain through npm/docker installs, checksum verification, postinstall scripts and Git SSH fingerprints, advocating commit signing and multi-signing of builds. Describes CI risks: opaque services, unsigned artifacts, and the need for artifact signing, transparency and audit logs. Reproducible builds are proposed as the solution but note compiler flags, timestamps and toolchain differences. Mentions reproducible builds, The Update Framework (TUF) and Bazel/toolchain pinning as concrete mitigations.
AI-written summary · about
chapters (20)
- 0:00Introduction to build security
- 1:05Trusting your development tools
- 3:09Verifying cryptographic security
- 5:56DNS and certificate trust issues
- 6:59Evaluating external dependencies
- 9:08Risks in package scripts
- 11:15Using dependency scanners
- 12:18Securing version control pushes
- 14:22Trusting CI systems
- 17:13Laptop vs build server security
- 18:16Reproducible builds approach
- 20:23Update framework for builds
- 21:50Reducing dependency vulnerabilities
- 22:36Disposable laptop environments
- 23:40Traceability in build decisions
- 24:43Balancing trust and verification
- 26:07Trust vs confidence in systems
- 27:30Legacy and vulnerability budgets
- 28:10Human interaction in security
- 29:14Conclusion and next steps
related talks
26mBuilding and Verifying Security Trust in Today’s Complex Tech Stacks ...
43mBuilding Trust Through Proactive Security - Key Parts of the Trus...
23mMastering Secure Software Supply Chains
37mUntrusted Execution: Attacking the Cloud Native Supply Chain
47mBuilding Trust in Open Source: A Practical Guide to Securing Your ...
45mSponsored Session: Because Security Matters: Securing Your Open Source Supply Chain
24mProtecting Ourselves from CNCFgate. Software Supply Cha...
33mGrowing the Chain: Trusting Build Provenance from Userspace