The State of Your Supply Chain - Andrew Martin, ControlPlane & Maya Kaczorowski, Google
Container security often focuses on runtime best-practices whilst neglecting the software shipped in the supply chain. Application or library vulnerabilities are a likely route to data exfiltration, and containers offer a new opportunity to mitigate this risk. Treating containers as immutable artefacts allows us to "upgrade" images by rebuilding and shipping whole images, avoiding configuration drift and state inconsistencies. This makes it possible to constantly patch software, and to easily enforce what is deployed into our environments. In this talk we detail an ideal software supply chain, describe the current state of the ecosystem, and dig into specific tools. Grafeas, Kritis, in-toto, Clair, Micro Scanner, TUF, and Notary are covered, and we demo how to identify a vulnerable image then automatically rebuild and redeploy it.
To learn more click here
Related events & webinars
View allIs the Internet on Fire? Strategies for Mitigating Open Source Software Vulnerabilities - Andrew Martin, ControlPlane & Michael Lieberman, Kusari
Open source is deployed everywhere, but is no longer trusted by default. Supply chain attacks via package registries, GitHub, and various accidental and entirely understandable vulnerabilities have proven that nothing is entirely secure.
InSPIREing Progress: How We're Growing SPIFFE & SPIRE in 2023 & Beyond- Daniel Feldman & Andrés Vega
SPIFFE/SPIRE keeps your data safe and hackers away by automatically assigning unique, secure credentials based on the unique properties of your software. It's a bit like a fingerprint scanner, but for code.
Kubernetes Supply Chain Security: The Software Factory - Andrew Martin, Control Plane
The original supply chain attack was described by Ken Thompson 35 years ago, in Reflections on Trusting Trust.
Speak to an expert
Engage with world-leading AI and cloud security specialists