WeAreDevelopers Logo WeAreDevelopers
Sign in
For You LIVE
World Congress 2024 • Aug 20, 2024 • Session details

Open Source Secure Software Supply Chain in action

Natale Vinto

Software supply chain attacks are escalating. Protect your development lifecycle using open-source tools like Sigstore and Tekton. Watch a live demonstration of shifting your pipeline security left.

Pause
Mute Enter Fullscreen
#1 about 3 min

Understanding the rise of supply chain attacks

An overview of why supply chain attacks are increasing and the importance of mitigating vulnerabilities.

#2 about 2 min

Core domains of software supply chain security

The critical role of software composition, content signing, and policy enforcement in securing applications.

#3 about 3 min

Open source tools for securing development pipelines

Implementing open source solutions to identify malicious code and safeguard build systems early.

#4 about 2 min

Securing deployments and enabling continuous monitoring

Strategies for checking compliance during deployment and monitoring runtime execution using open source tools.

#5 about 3 min

Essential supply chain security terminology and standards

A review of critical acronyms and the SALSA framework levels for defining platform security.

#6 about 8 min

Designing a security-augmented software delivery process

Implementing a shift-left approach with opinionated pipelines and keyless signing workflows.

#7 about 4 min

Scaffolding secure applications with developer portal templates

Using enterprise portal templates to automatically configure base images, secure pipelines, and deployments.

#8 about 5 min

Scanning dependencies and mitigating vulnerabilities locally

Utilizing IDE extensions to analyze dependencies and update base images before committing code.

#9 about 2 min

Keyless commit signing and secure pipeline execution

Authenticating via OIDC to sign commits seamlessly and trigger automated security checks.

#10 about 5 min

Analyzing software bills of materials and runtime compliance

Inspecting generated SBOMs and verifying runtime container compliance against industry security benchmarks.

Matching moments

2:46 min

Mapping the complete software supply chain attack surface

Matthew Brady Matthew Brady · World Congress 2026 Europe

3:36 min

Understanding software supply chain threats and security risks

Andrei Epure Andrei Epure · World Congress 2024

1:37 min

Introduction to supply chain security principles

Zbyszek Tenerowicz · LIVE

4:00 min

Core principles for implementing DevSecOps in teams

Aarno Aukia · LIVE

2:36 min

Addressing vulnerabilities in software supply chains

Thijs Feryn Thijs Feryn · World Congress 2026 North America

2:35 min

Integrating security across the application development lifecycle

Niels Tanis Niels Tanis · World Congress 2022

More from World Congress 2024

Beyond the Hype: Real-World AI Strategies Panel thumbnail
24:07
about 1 year ago

Beyond the Hype: Real-World AI Strategies Panel

Mike Butcher, Jürgen Müller, Katrin Lehmann, Tobias Regenfuss

Carl Lapierre - Exploring Advanced Patterns in Retrieval-Augmented Generation thumbnail
21:17
almost 2 years ago

Carl Lapierre - Exploring Advanced Patterns in Retrieval-Augmented Generation

Carl Lapierre

Coding an Immersive Copilot using Unity / .NET and Azure OpenAI! thumbnail
31:50
about 2 years ago

Coding an Immersive Copilot using Unity / .NET and Azure OpenAI!

Zaid Zaim

Building a diverse tech company: The power of Diversity, Equity, Inclusion, and Belonging thumbnail
29:43
about 2 years ago

Building a diverse tech company: The power of Diversity, Equity, Inclusion, and Belonging

Sue Quackenbush

Livecoding with AI thumbnail
31:39
about 2 years ago

Livecoding with AI

Rainer Stropek

Dapr in Practice thumbnail
24:08
about 2 years ago

Dapr in Practice

marcklefter

Upcoming sessions on this topic

Open session

Supply Chain Security for the Everyday Engineer

  • Pradumna Saraf

    Kestra Technologies

    Quality Assurance Engineer

Open session

Beware of Strangers Bearing Code: Open Source Trust in the Agent Era

  • Vikram Vaswani

    Consultant

Open session

Speed or Security? Why Not Both for Your Coding Agents

  • Ajeet Raina

    Docker

    Developer Advocate

Open session

From Prompt Engineering to Harness Engineering: Building Observable and Governed GenAI Systems

  • Lakshmi Devi Prakash

    JPMorgan Chase

    VP, Applied AI/ML Lead

Open session

What I Got Wrong Shipping an MCP Server for Live Infrastructure

  • Pritesh Kiri

    Harness

    Developer Relations Engineer

Open session

Beyond File Dumps: Context Engineering for Coding Agents

  • Animesh Dutta

    Arm

    Senior Software Engineer

Related videos

Securing your application software supply-chain thumbnail
28:27
World Congress 2022 • over 4 years ago

Securing your application software supply-chain

Niels Tanis

Walking into the era of Supply Chain Risks thumbnail
37:36
LIVE • over 4 years ago

Walking into the era of Supply Chain Risks

Vandana Verma

Supply Chain Security and the Real World: Lessons From Incidents thumbnail
24:47
World Congress 2025 • about 1 year ago

Supply Chain Security and the Real World: Lessons From Incidents

Adrian Mouat

Stranger Danger: Your Java Attack Surface Just Got Bigger thumbnail
1:58:59
LIVE • over 4 years ago

Stranger Danger: Your Java Attack Surface Just Got Bigger

Vandana Verma Sehgal

Security Pitfalls for Software Engineers thumbnail
27:32
World Congress 2023 • about 3 years ago

Security Pitfalls for Software Engineers

Jasmin Azemović

Beyond SBOMs: The Future of Container Supply Chain Security thumbnail
30:38
World Congress 2026 Europe • 3 months ago

Beyond SBOMs: The Future of Container Supply Chain Security

Mohammad-Ali A'râbi

Related articles

From learning to earning

Jobs that call for the skills explored in this talk.