Cybersecurity with CDF & OpenSSF Focus Group
summary
Less than half of companies generate SBOMs today, yet SBOMs attached to revenue are already forcing adoption for government contracts; some teams produce both source and container SBOMs and then get back huge CVE spreadsheets. Practical fixes discussed include hermetic builds, Tecton pipeline tasks, Salsa provenance and an events registry, and debloating that removed 250 transitive components and produced a ~50% vulnerability reduction in one study.
AI-written summary · about
chapters (8)
- 0:00Introduction
- 9:01SBOM generation challenges
- 14:00Gold pipelines in CI/CD
- 22:43Pipeline interoperability
- 31:35AI in DevOps workflows
- 41:13AI-driven pipeline diagnosis
- 53:10Software debloating security
- 1:06:21CI/CD future next steps
related talks
29mUnlocking the Power of SBOMs: A Deep Dive into Risk Management and Cybersecurity Posture
44mNavigating Open Source and Open Standards for Better Cybersecurity
27mSecuring Open Source With SBOM: From Visibility To Trust
22mSBOM and Security Transparency - How it all fits together
45mWhat’s in a Name? Vulnerabilities, SBOMs, and the Challenge of Software Identity
29mMaking Software Bill of Materials (SBOMs) Actionable
12mKeynote: DevSecOps and the Art of Not Ending Up On the Front Page
37mSecuring OSS across the whole supply chain and beyond