Building SLSA 3 Conforment Attestors for Artifacts Generated on GitHub
34 min

Building SLSA 3 Conforment Attestors for Artifacts Generated on GitHub

KubeCon + CloudNativeCon - KubeCon + CloudNativeCon Europe 2023
Ian Lewis Asra Ali
slsa supply-chain-security github-actions software-supply-chain provenance attestation container-images ci-cd open-source-security build-automation security-frameworks
Filling the Gaps in Kubernetes Flavored SLSA with Threat Modeling
34 min

Filling the Gaps in Kubernetes Flavored SLSA with Threat Modeling

KubeCon + CloudNativeCon - KubeCon + CloudNativeCon Europe 2023
Christie Wilson Priya Wadhwa
kubernetes slsa supply-chain-security threat-modeling ci-cd tekton spire sigstore container-security security-frameworks
Maintaining TUF
35 min

Maintaining TUF

KubeCon + CloudNativeCon - KubeCon + CloudNativeCon Europe 2023
Joshua Lock Lukas Pühringer
tuf supply-chain-security container-security cloud-native security frameworks reference-implementation kubernetes secure-delivery
A Look Under the Hood of CNCF Security Audits
31 min

A Look Under the Hood of CNCF Security Audits

KubeCon + CloudNativeCon - KubeCon + CloudNativeCon Europe 2023
Adam Korczynski David Korczynski
cncf security-audits cloud-native open-source-security threat-modeling vulnerability-management cve salsa-compliance supply-chain-security argo cilium flux
Malicious Compliance: Reflections on Trusting Container Scanners
36 min

Malicious Compliance: Reflections on Trusting Container Scanners

KubeCon + CloudNativeCon - KubeCon + CloudNativeCon Europe 2023
Ian Coldwater Duffie Cooley Brad Geesaman Rory McCune
container-scanning kubernetes security vulnerability-management docker sbom ci-cd supply-chain-security policy-as-code cloud-native alpine-linux go
The Top 10 List of Istio Security Risks and Mitigation Strategies
35 min

The Top 10 List of Istio Security Risks and Mitigation Strategies

KubeCon + CloudNativeCon - KubeCon + CloudNativeCon Europe 2023
José Carlos Chávez
istio security kubernetes cloud-native service-mesh networking observability authorization authentication mtls supply-chain-security web-application-firewall
Securing the Container Supply Chain with Notary
36 min

Securing the Container Supply Chain with Notary

KubeCon + CloudNativeCon - KubeCon + CloudNativeCon Europe 2023
Justin Cormack Toddy Mladenov
container-security supply-chain-security notary docker microsoft oci kubernetes signing sbom in-toto key-management
Secure Your Project with the SIG Release Supply Chain Kit
30 min

Secure Your Project with the SIG Release Supply Chain Kit

KubeCon + CloudNativeCon - KubeCon + CloudNativeCon Europe 2023
Adolfo García Veytia Carlos Panato
supply-chain-security sbom slsa container-signing github-actions ci-cd kubernetes release-engineering provenance cosign six-store software-supply-chain
Staring Into the Abyss with the Security Technical Advisory Group
25 min

Staring Into the Abyss with the Security Technical Advisory Group

KubeCon + CloudNativeCon - KubeCon + CloudNativeCon Europe 2023
Michael Lieberman Marina Moore
cncf cloud-native security supply-chain-security threat-modeling security-assessments zero-trust kubernetes open-source-security security-controls architecture design-patterns
Image Signing and Runtime Verification at Scale: Datadog's Journey
34 min

Image Signing and Runtime Verification at Scale: Datadog's Journey

KubeCon + CloudNativeCon - KubeCon + CloudNativeCon Europe 2023
Ethan Lowman
container-security image-signing runtime-verification kubernetes datadog supply-chain-security oci containerd grpc public-key-cryptography sigstore ci-cd
Back to the Future: Next-Generation Cloud Native Security
30 min

Back to the Future: Next-Generation Cloud Native Security

KubeCon + CloudNativeCon - KubeCon + CloudNativeCon Europe 2023
Matt Jarvis Andrew Martin
cloud-native-security kubernetes containers webassembly rust ebpf confidential-computing post-quantum-cryptography ai-security supply-chain-security vulnerability-management hardware-security
Kubernetes Security Response Committee: Intro & Deep Dive
35 min

Kubernetes Security Response Committee: Intro & Deep Dive

KubeCon + CloudNativeCon - KubeCon + CloudNativeCon Europe 2023
Monis Khan Micah Hausler
kubernetes security vulnerability-management cve bug-bounty cloud-native aws microsoft api-security supply-chain-security