Policy To Pipeline: How OSPOs Can Power Regulatory Readines...
summary
Claims OSPOs shift from reactive gatekeepers to proactive enablers by embedding compliance into CI/CD and upstreaming fixes; a live demo builds a reference pipeline using ScanCode, DejaCode & PLDB, VulnerableCode and CycloneDX/SPDX to generate, enrich and load SBOMs, produce attribution docs, run vulnerability matching (including snippet/AI-match), and surface alerts that can fail or block deploys (Kubernetes optional). Demo notes 23 million packages indexed and daily vulnerability updates.
AI-written summary · about
chapters (10)
- 0:00OSPOs and regulatory readiness
- 1:49Global software security pressures
- 3:56OSPOs as compliance enablers
- 7:08Reactive to strategic compliance
- 9:55Upstream engagement and intelligence
- 13:04Security-focused open source contributions
- 16:21Automated compliance demo
- 28:45Advanced tooling plans
- 31:37Q&A on HR policies
- 35:14Closing and Kubernetes options
related talks
35mOne Pipeline, Three Regulator - SBOM Compliance for the Developer
33mAutomating Industry Regulation (SoX, SoC 2) Enforcement...
34mSupply Chain Security, SBOMs and How OSPOs Can Play An Important Role Going Forward - An Ecosystem and Compliance Update
24mAutomating Enterprise/Industry Regulation Enforcements During Software Delivery
15mPolicy control for Software Supply Chain
26mHow’s Your Supply Chain with Your Insecure OSS Ingestion?
26mProtect the Pipe! A Policy-based Approach for Securing CI/CD Pipe...
32mBuilding a Secure By-Design Pipeline with an Open Source Stack