Using CNCF Best Practices for Software Supply Chain to Guide and Enha...
summary
CNCF best practices become an actionable control framework: mapping 22+ principles into a spreadsheet of control objectives, owners and evidence, then assessing GitHub/TFS, Artifactory/Nexus and CI pipelines (Kubernetes/Tekton) against them. Practical measures include in-toto recommendations, automated SCA (Black Duck/Sonatype style) and secret scanning, producing an enterprise SBOM workflow and a tested paved road of certified build artifacts. Results show clearer inventory, faster Log4j response, executive buy-in and monthly ROI metrics proving time saved by automation.
AI-written summary · about
chapters (14)
- 0:00Intro
- 0:43Ryan Gibbons 3M
- 1:51Software Supply Chain
- 4:10How This Worked at 3M
- 9:24Where Did We Start
- 11:42Before and After
- 13:19DevSecops
- 14:55Joe Bidens Executive Cyber Security Order
- 16:18The CNCF Document
- 16:57What is it about
- 18:25The document
- 22:06Conors approach
- 30:01Dynamic Inventory
- 30:42Lessons Learned
related talks
24mProtecting Ourselves from CNCFgate. Software Supply Cha...
33mChain Reaction: Remixing CNCF’s Supply Chain Security Guide for 2025
10mSupply Chain Security Reference Architecture
28mThe role of CDEs in securing your software supply chain
23mMastering Secure Software Supply Chains
52mIntroducing the Secure Supply Chain Consumption Framework (S2C2F)
08mKeynote: Approaching the SBOM: Best Practice for Software Supply Chain Security
16mSecuring the Modern Software Supply Chain: A Beginner’s Guide To SLSA, SBOM, and Beyond