From development to release: Protecting the software supply chain
summary
Describes concrete measures to protect the software supply chain by introducing SLSA levels 1–4 as incremental gate criteria, mandating IDE linting and pre-commit static checks, adding build-time scans, and requiring image signing and registry verification while keeping runtime detection as a last line. Cites Sonatype data on rising supply-chain attacks and a Gartner prediction about widespread compromises, and shows specific tools and workflows: CI/CD gate points, SBOM production plus SBOM signing and verification, and rules for when each check must fail the pipeline.
AI-written summary · about
chapters (16)
- 0:00Cloud Native supply chain security
- 4:38Threats and vulnerabilities
- 8:14SALSA security framework
- 10:03FRESCA and S2C2F frameworks
- 12:11CNCF White Paper
- 14:42DevSecOps and shift left
- 17:34Code security controls
- 20:03Quality Gates in CI/CD
- 22:55Runtime security and monitoring
- 23:37Open Source role
- 25:08Securing existing pipeline
- 26:33Secret management best practices
- 27:39Code analysis vs secrets
- 28:42Speed versus security trade-offs
- 30:07Vulnerability management bottlenecks
- 32:15Security validation and pentesting
related talks
35mPractical Guides for Enhancing Your Software Supply Chain Security
16mSecuring the Modern Software Supply Chain: A Beginner’s Guide To SLSA, SBOM, and Beyond
22mSofware Supply Chain Security Is Hard. But Does it Need to Be?
23mMastering Secure Software Supply Chains
29mGoogle SLSA & NIST SSDF: Emerging Software Supply Chain Security Best Practices
36mSecure your software supply chain from dependencies to deployment
20mAnalyzing Google’s SLSA Framework for Securing Software Supply Chains
59mIntroduction to SLSA