OpenGovCon @ Open Source Summit North America 2023
2023-05-10..2023-05-12
Vancouver, Canada
as the organisers put it
OpenGovCon provides a focused experience built to accelerate federal service delivery. Join us as we connect federal policy owners, federal mission owners, and innovative federal and commercial…
who it's for
federal policy owners, security engineers, platform engineers, devops engineers, cloud architects, supply chain security engineers, software engineering managers
topics
SBOM tooling and validation; VEX minimum requirements; SSDF-aligned CI/CD pipelines; Platform One and Iron Bank; container and Kubernetes hardening; Azure AD conditional access; Sentinel UEBA and Defender for Cloud; OpenSSF scorecards and validators; real-time SignalR + React integrations; WASM runtimes and microservices; artifact curation for GovCloud (air-gapped); typo-squatting and supply-chain attacks
| title | author | length |
|---|---|---|
| Key Steps the US Government Is Taking to Improve Citizens Everyday... | Justin Murphy, Rob Vietmeyer | 39m |
US government agencies roll out concrete steps: publishing s-bom tooling and working groups, releasing VEX minimum requirements and running a VEX working… | ||
| Panel Discussion: How the US DOD is Using Software Factories to... | Kyle Fox, Bunny Banowsky, Camdon Cady, Mark Galpin, Dan Fedick | 37m |
DoD grows its software factory count from a handful to nearly two dozen in three years and builds reusable CI/CD artifacts like Platform One pipelines, Iron… | ||
| The Supply Chain Conundrum: Why Traditional Application Security Is... | Erez Yalon, Adam Nygate | 46m |
Claim: vulnerability-focused tooling misses unrecognized risk that averages 4.5 years between bug introduction and fix, while recognized risk is only ~3… | ||
| Zero Trust Best Practices in Government and Federal Industries | Lili Davoudian | 34m |
Defines a practical Zero Trust path with concrete tools and numbers rather than buzzwords: use Azure AD Conditional Access for policy-based MFA and anomalous… | ||
| Hardening Next Generation Military Software Containers for Use by... | Russ Andersson, Sam Kreimier | 39m |
A vendor hardens ironbank/Platform One containers by rebasing onto UBI8, using IronBank base images, adding licensing and obfuscation, and integrating into a… | ||
| Zero Trust: Getting to Step One..and What to Do When You Get There | John Kindervag, Jonathan Flack | 45m |
Claims that Zero Trust reduces breaches by removing implicit network trust and uses a five-step model: define a protect surface (data, applications, assets… | ||
| Navigating Open Source and Open Standards for Better Cybersecurity | Jeffrey Borek, Arnaud J Le Hors | 44m |
Argues that security gaps stem from tooling, incentives and fragmentation, citing surveys: 66% of security teams do not share data and 84% say integration… | ||
| Using OSS (SignalR, React) to Connect Users to an API in NRT (Near-Real Time) | Zachary Gardner | 30m |
A WebSocket pipeline using SignalR (WebSockets) and a React UI relays Avaya agent desktop events to specific browser tabs, pre-populates patient demographics… | ||
| Trusting Your Open-Source Software Supplier | Ross Bryant | 25m |
Maps open source use to NIST SSDF and SP 800-161 and walks SBOM requirements to real attacks: scans across npm PyPI Maven et al. find 18,000 packages executing… | ||
| Microservices and WASM, Are We There Yet? | Will Christensen, Kingdon Patrick Barrett | 35m |
Tried to build a Kubernetes operator that loads polyglot WASM modules as sandboxed hooks and ran demos using Spin, WASI/WAGI, WasmEdge, Wasmtime, Wasmer, Go… | ||
| Acquiring & Retaining Great Government Tech Talent | Clyde Seepersad | 38m |
Government hiring still lacks cloud-native skills like Kubernetes and DevOps and sees shifting layoffs with 45% senior cuts while demand for cloud, security… | ||
| Curating and Securing Open Source for the GovCloud | Sudhindra Rao | 40m |
Developers cut turnaround from days to hours by automating four pipelines: preparation workflow generates a JSON manifest of requested packages and transitive… | ||
| Automating the DoD Container Hardening Pipeline | Russ Andersson | 27m |
Pipeline automates container hardening for DoD via runtime instrumentation that learns production behavior, prunes packages and fixes vulnerabilities, yielding… | ||
| Preparing for Constant Change With Quantum Agility | Tim Serewicz | 37m |
Quantum threatens common encryption within a few years and one quantum machine can find a flaw that existing cloud CPUs then use to decrypt petabytes of… | ||
| nothing matches | ||