Keynote: Software Supply Chains for Devops
summary
Cloud-focused checklist for reducing mean-time-to-detection and understanding: captures which artifacts, checks and timestamps are needed so rollback and root-cause queries work. Demonstrates concrete GCP tooling: Cloud Source Repositories for source-version provenance, Cloud Build for build metadata, on-demand and continuous image scanning (example report shows 74 vulnerabilities and 0 critical), Container Analysis API for storing metadata, and Binary Authorization attestation policies to block untrusted images at deploy time. Continuous scanning updates results when CVE severity changes.
AI-written summary · about
chapters (11)
- 0:00Intro
- 0:31Modern Challenges in Software Supply Chains
- 2:33Incident: Observability to the Rescue
- 4:01View Cloud Audit Logs from Cloud Source Repositories
- 4:24Cloud Build
- 4:52On-Demand & Container Scanning
- 5:06On-Demand Scanning results
- 5:57Vulnerability results in Artifact Registry
- 6:42Binary Authorization
- 7:58Container Analysis API
- 8:37GCP Software Supply Chains Solutions
related talks
12mKeynote: A Vision for a Secure Software Supply Chain
36mSecure your software supply chain from dependencies to deployment
09mKeynote: Supply Chain: The New Threat Vector in Cloud Native Security
12mKeynote: DevSecOps and the Art of Not Ending Up On the Front Page
19mFrom Code to Cloud: Embedding Security
42mThe Data Behind DevSecOps: The Power of Hindsight to Protect your Supply Chain
28mCode, Dependencies and Security: Where Is the Risk
11mKeynote: Like a Magic Eye Illusion: Seeing the Bigger Picture for Cloud-Native S...