Keys to Building Trusted Software in Cloud Native Pipelines

You’ve started to shift security left in order to catch security issues earlier in development, but are you using trusted, verified open source software components when writing your code? Are you signing your code commits and image builds so deployment tooling and processes can verify authenticity with auditable components?

In this session, we discuss steps to trust – but verify – the same open source software packages you have come to rely on. You will see how to stay ahead of regulatory and compliance standards and leave this talk with a deeper understanding of how to access a curated content repository library with provenance and attestations that are maintained to SLSA standards and more!

Agenda

• Identify source code transitive dependencies and vulnerabilities for both in-house and COTS applications from a local IDE

• Digitally sign code commits as well as images, to store attestations of the build pipeline that can then be shared, reused.

• Verify code commits for keyless git signing, with an immutable ledger to validate the artifact metadata

• Manage, monitor and analyze relationships with your security metadata (SBOMs, VEXs)