Untrusted Execution: Attacking the Cloud Native Supply Chain
summary
Risk-models map specific attack chains from compromised dependencies to runtime execution and show which steps must be broken to stop exploits. The team demonstrates a working reference implementation (Fresca) that uses Tekton pipelines to produce signed SBOMs and in-toto provenance, pushes artifacts and attestations to an OCI registry and a transparency log (Sigstore / Rekor), and enforces deployment via admission policies and runtime attestations supplied by Spire & Vault. The demo proves end-to-end verification is practical for Kubernetes CI/CD, not just theoretical.
AI-written summary · about
chapters (11)
- 0:00Introduction
- 1:12Talk overview
- 4:38Cloud native supply chain problem
- 8:52Supply chain threat modeling
- 13:04Open source controls
- 17:18Pre-build integrity
- 25:03Build phase controls
- 27:57Post-build verification
- 30:10Kubernetes with Fresca
- 34:03Conclusion
- 35:49Q&A
related talks
34mUntrusted Execution: Attacking the Cloud Native Supply Chain - Francesco Beltramini
37mUntrusted Execution: Attacking the Cloud Native Supply Chain
36mKubernetes Supply Chain Security: The Software Factory
20mPutting the Supply Chain Pieces together: A Deep Dive into the Secure softwar...
22mCloud Native Supply Chain Security with Tekton and Sigstore
15mEnforcing a Secure Supply Chain on Kubernetes
50mSupply Chain Security for Cloud Native Java.
09mKeynote: Supply Chain: The New Threat Vector in Cloud Native Security