Our Dependence on Open Source Is Scary. SLSA, SBOM and Sigstore to the Rescue
summary
The talk reviews real software supply-chain breaches (SolarWinds, a Homebrew compromise, Coop POS incident, a long‑running XZ→SSH backdoor, and a CircleCI AWS key leak) and presents practical defenses: adopt SLSA levels for build provenance, produce SBOMs (with tools like syft and jib), and sign artifacts using the Sigstore ecosystem. A demo shows using cosign to sign container images, attach SBOMs, and enforce deployment in Kubernetes via an admission controller that rejects unsigned or mismatched images.
AI-written summary · about
chapters (8)
- 0:00Software security introduction
- 2:11Supply chain vulnerabilities
- 15:59Zero Trust and Shift Left
- 18:26SLSA software security framework
- 23:21SBOM dependency inventory
- 25:47Cosign demo
- 34:37Summary and best practices
- 35:20Q&A
related talks
36mOur dependency on Open Source is scary. SLSA, SBOM and Sigstore to the rescue
30mSecuring Open Source Supply Chains
43mSLSA, SigStore, SBOM & Software Supply Chain Security. What does it all mean?
39mOpen Source Software Supply Chain Security — Why does it matter?
12mKeynote: DevSecOps and the Art of Not Ending Up On the Front Page
16mSecuring the Modern Software Supply Chain: A Beginner’s Guide To SLSA, SBOM, and Beyond
15mSoftware Supply Chain Security for those in a rush
47mBuilding Trust in Open Source: A Practical Guide to Securing Your ...