devsecopsday 2023
who it's for
security engineers, devops engineers, platform engineers, kubernetes operators, site reliability engineers, compliance engineers, engineering managers
topics
software supply chain security; SBOM signing and verification; SLSA levels 1-4; Tekton provenance and Chains; Sigstore Fulcio and Rekor; Rego policies for OPA; Trivy vulnerability scanning; Sealed Secrets with kubeseal; HashiCorp Vault tradeoffs; Falco runtime threat detection; Prometheus + Alertmanager observability; service account rotation and JWT client_credentials
| title | author | length |
|---|---|---|
| From development to release: Protecting the software supply chain | Luca Bandini | 34m |
Describes concrete measures to protect the software supply chain by introducing SLSA levels 1–4 as incremental gate criteria, mandating IDE linting and… | ||
| Securing secrets in the GitOps era | Davide Imola | 29m |
Explains concrete ways to store secrets for GitOps on Kubernetes, showing how Sealed Secrets plus a Helm operator and the kubeseal CLI encrypt secrets with the… | ||
| The automated DevSecOps governance model with Rego and Trivy | A. Panisson | 37m |
Explains an automated DevSecOps governance model using Open Policy Agent Rego rules enforced during Trivy scans. Shows creating a Rego policy that requires… | ||
| Supply Chain Attacks and the Future of Software Delivery | Gianluca Varisco | 37m |
Describes how supply-chain attacks are a growing portion of incidents (about 20%), with examples like SolarWinds (build-system compromise and signed malicious… | ||
| Service Account: With Great Powers Come Great Responsibilities | Giovanna Monti | 33m |
A platform feature for managing service accounts that creates, stores and rotates credentials, enforces automatic rotation and expiry notifications, and limits… | ||
| Spreading Sec across DevOps loops | Giorgia Rondinini | 34m |
Move security checks into the inner development loop by running scans and tests inside Docker images locally instead of waiting for outer-loop CI. Use DevSpace… | ||
| Kubernetes proactive threat detection with Falco and Prometheus | Matteo Renzi | 39m |
A working observability stack for Kubernetes that detects runtime threats using Falco and Prometheus. Falco captures syscalls with auto-updating Falco rules… | ||
| Protect your software supply chain with Tekton and Sigstore | Giovanni Galloro | 34m |
Demonstrates a Tekton CI pipeline that builds a container image, captures SLSA v1.0 provenance, and produces an image URL and digest. The pipeline signs… | ||
| Shift Left and Security-as-Code: Security on Kubernetes | Giulio Todini | 34m |
A concrete workflow for securing Kubernetes using NeuVector is presented: install NeuVector via its Helm chart, let it learn runtime behavior by deep-packet… | ||
| nothing matches | ||