Protecting Ourselves from CNCFgate. Software Supply Cha...
summary
Document outlines five end-to-end sections and recommends concrete controls: enforce MFA and signed git commits, scan and validate dependencies with SBoM plus provenance checks or build-from-source for high-risk libraries, run hardened immutable pipelines composed of single-purpose containerized build steps, and use reproducible builds plus metadata signing with in-toto and notary before publishing. Gaps listed include metadata storage and transparency logs (six store / record) and the plan is to produce a reference architecture and implementation.
AI-written summary · about
chapters (11)
- 0:00Intro
- 0:25Why is Cloud Native Supply Chain a Problem?
- 2:33Navigating Supply Chain Security in Cloud Native
- 4:57Five Main Areas
- 5:42Securing the Source Code Start with the basics...
- 6:43Securing the Dependencies • Scan & Validate dependencies • Remember - CVE's are a trailing indicatorl Look for operational hygiene
- 11:04Securing the Build Pipeline Step 1: Read the DoD DevSecOps Reference Paper
- 14:55Reproducible Builds
- 19:01Unresolved Challenges
- 20:22Framework with common tools and templates
- 21:50Get Involved
related talks
23mMastering Secure Software Supply Chains
49mMitigate Risks In Code: Protect Your Software based Supply Chain
37mUntrusted Execution: Attacking the Cloud Native Supply Chain
35mSecuring the Perimeter - CFCR/CFAR Chain of Custody With CI/CD Pipelines
35mUsing CNCF Best Practices for Software Supply Chain to Guide and Enha...
28mThe role of CDEs in securing your software supply chain
32mSoftware Supply Chain Security
30mSecuring Open Source Supply Chains