Keynote: DevSecOps and the Art of Not Ending Up On the Front Page
summary
SolarWinds-style supply-chain compromises spread signed malware through updates and prompt Executive Order 14028 requiring SBOMs for US federal procurements. Audits show 3/4 of codebases are open source, 81% of that code has at least one vulnerability, and currently less than half of companies produce SBOMs. Practical defenses listed include SBOM formats like SPDX and CycloneDX, provenance and attestation (SLSA, sigstore), CI builders and runners (Tekton, Jenkins, Cartographer), and policy/enforcement tools such as OPA; Kubernetes 1.24 is the first release verifiable with sigstore.
AI-written summary · about
chapters (6)
- 0:00Start
- 1:41How deep is your stack? 78% of code in codebases is open source
- 4:15Compliance because you have to
- 6:08Compliance because you want to
- 8:15Inserting "Sec" into "DevOps"
- 9:46Get started today!
related talks
43mOur Dependence on Open Source Is Scary. SLSA, SBOM and Sigstore to the Rescue
39mOpen Source Software Supply Chain Security — Why does it matter?
37mSecuring OSS across the whole supply chain and beyond
30mSecuring Open Source Supply Chains
19mKeynote: Supply Chain Security in 2024
15mSoftware Supply Chain Security for those in a rush
40mPractical guides for enhacing your Software Supply Chain Security
12mKeynote: A Vision for a Secure Software Supply Chain