A Different Kind of S3: First Line Security of the Supply Chain
summary
Three concrete defenses: produce and store SBoMs (required by the U.S. government, and they let teams quantify Log4j exposure), adopt cryptographic signing with tools like Sigstore (proof of provenance today but low adoption and unresolved key-management/revocation questions), and apply automated slimming (Docker Slim / Slim.AI container profiles) to cut attack surface, speed CI/CD, and lower cloud costs. Slim.ai offers an automated pipeline and free container profiles; cross‑team sharing rounds out the program—Gartner cites 52% CTO–CSO and 29% CTO–CDO regular engagement.
AI-written summary · about
chapters (4)
related talks
18mA Different Kind of S3: First Line Security of the Supply Chain
18mA Different Kind of S3: First Line Security of the Supply Chain
43mSLSA, SigStore, SBOM & Software Supply Chain Security. What does it all mean?
37mSecuring OSS across the whole supply chain and beyond
15mSoftware Supply Chain Security for those in a rush
34mFrom development to release: Protecting the software supply chain
36mSecure your software supply chain from dependencies to deployment
38mChallenge Accepted: 3 Experts, 3 Big Ideas on Supply Chain Security