A Different Kind of S3: First Line Security of the Supply Chain
Talkat ContainerCon @ Open Source Summit Europe 2022 · on Friday, 2022-09-16· at 15:55· Wicklow Hall 2A (Level 2), Convention Centre Dublin, Spencer Dock, N Wall Quay, North Wall Dublin 1, D01 T1·
summary
Three concrete defenses: SBOMs for inventory and retrospective exposure mapping, Sigstore signing (also noting Notary) to attach cryptographic provenance, and automated slimming with Docker Slim / slim.ai to remove unused libs so images shrink, reveal fewer vulnerabilities, speed CI/CD and lower cloud costs. Slim.ai ships container profiles that show filesystem, metadata and attack surface. Cites industry gaps — 52% of CTOs engage their CSO and only 29% with their CDO — and adds sharing as an explicit operational step.
AI-written summary · about
chapters (5)
- 0:00Start
- 6:04Summary
- 6:53A Reactive Approach to Software Supply Chain Security
- 7:55First Step Signing
- 10:30Pros and Cons around Signing
related talks
18mA Different Kind of S3: First Line Security of the Supply Chain- 18mA Different Kind of S3: First Line Security of the Supply Chain
43mSLSA, SigStore, SBOM & Software Supply Chain Security. What does it all mean?
37mSecuring OSS across the whole supply chain and beyond
38mSecuring the chains: Building defensive layers for software supply chains
38mChallenge Accepted: 3 Experts, 3 Big Ideas on Supply Chain Security
15mSoftware Supply Chain Security for those in a rush
28mBuilding Images for the Secure Supply Chain