Shield your #Java Code Practical Guides for Trusted Software
summary
Starts from history (Equifax 143 million records, $1.5B; Log4Shell >$10B; Spring4Shell ~$50M) and shows a working Java secure supply chain: a Quarkus chatbot built with Maven, cloud VS Code IDE, SonarQube static scans, dependency analysis flagging four vulnerabilities, upgrade from Quarkus 3.15.1 to 3.19.2 to fix them, CI/CD via Argo CD and Tekton-style pipelines, image signing and verification using sigstore and SBOMs, enterprise contract policy checks, and successful deployment to Kubernetes.
AI-written summary · about
chapters (9)
- 0:00Introduction and speaker intro
- 3:39Java security breaches history
- 11:32Secure software development lifecycle
- 23:12Demo setup and internal developer portal
- 34:00Dependency analysis and vulnerability scanning
- 41:07Code review and CI/CD pipeline
- 42:54Container image signing and verification
- 48:19Environment promotion with enterprise contract
- 51:46Closing and Q&A
related talks
46mStrengthening Java Apps: Best Practices in Secure Coding for Java Developers
02h 38mJava application security the hard way - a workshop for the serious developer
48mThe Hidden Security Hazards in Your Java Stack
49mWargames - Java vulnerabilities and why you should care
57mReal World Lean Java Practices, Patterns, Hacks and Workarounds
34mDevOps Tools for Java Developers
28mCode, Dependencies and Security: Where Is the Risk
49mAn overview of available opensource tools to secure your Java code