Talks

The current state of the software supply chain, the significant global recent events (SolarWinds, log4shell, codecov), the state of the open source ecosystem, the threats and the mitigations that can be applied using tools like Sigstore, Syft and Grype for digital signatures, SBOM generation and automatic vulnerability scanning, and how to use them to improve integrity and to gain unprecedented levels of knowledge of your digital artifacts and your cloud infrastructures.

What the software supply chain is, common threats and mitigations, and how they apply to the IaC ecosystem too. Security threats using Terraform and its ecosystem, then OCI images, digital signatures and SBOM using Sigstore and Syft. A live coding session deploying secure OCI images on a Kubernetes cluster with security policies built with Kyverno, including security scanning from the generated SBOM.

What the software supply chain is, common threats and mitigations, and how they apply to the IaC ecosystem too. Security threats using Terraform and its ecosystem, then OCI images, digital signatures and SBOM using Sigstore and Syft. A live coding session deploying secure OCI images on a Kubernetes cluster with security policies built with Kyverno, including security scanning from the generated SBOM.

The current state of the software supply chain, the big global recent events (SolarWinds, log4shell, codecov, packagist), the state of the PHP and Drupal ecosystem, the threats and the mitigations that can be applied using tools like Sigstore, Syft and Grype for digital signatures, SBOM generation and automatic vulnerability scanning, and how to use them on real projects to gain unprecedented levels of knowledge of your digital artifacts.

The current state of the software supply chain, the big global recent events (SolarWinds, log4shell, codecov, packagist), the state of the PHP and Drupal ecosystem, the threats and the mitigations that can be applied using tools like Sigstore, Syft and Grype for digital signatures, SBOM generation and automatic vulnerability scanning, and how to use them on real projects to gain unprecedented levels of knowledge of your digital artifacts.

L'infrastruttura come codice e le applicazioni cloud-native consentono di raggiungere livelli senza precedenti di efficienza e governance dei nostri servizi cloud, rendendoci capaci di creare infrastrutture immutabili e ripetibili, di poterci operare come se fossero applicazioni quindi versionando il codice, qa e test automatici e procedure di rilascio automatiche verso gli ambienti di destinazione. Più inseriamo codice nelle nostre infrastrutture, più estendiamo la superficie di attacco. In questo talk esaminerò gli attacchi alla catena di approvvigionamento a diversi livelli, come rilevarli, le tecniche per mitigarli e come scrivere codice IaC più sicuro.

AdditronK8S is a retro game machine built as a Kubernetes custom controller, implemented in JavaScript.