Cloud Native
Security Talks RSS

CloudNativeSecurityCon Europe 2022

Securing the Supply Chain with Witness

Cole Kennedy, TestifySec

Abstract

Witness is a new open-source modular framework for supply chain security. Witness works by making collections of attestations that are bound to the CI process. These attestation collections give administrators trusted sectors on which to enforce policy no matter where the policy enforcement point is. Witness is an implementation of in-toto and integrated with cloud-native security tools such as rekor, spire, cosign and Kubernetes. In this talk we will describe the witness trust model and offer a demonstration of implementation in a CI pipeline.Click here to view captioning/translation in the MeetingPlay platform!

More from CloudNativeSecurityCon Europe 2022

Open in the index →
  1. VEX! or... How to Reduce CVE Noise With One Simple Trick!Frederick Kautz 2022-05-16
  2. Using CNCF Best Practices for Software Supply Chain to Guide and Enhance Your Security PostureRyan Gibbons, 3m & Conor Rogers, Stelligent 2022-05-16
  3. The Unexpected Demise of Open Source LibrariesLiran Tal, Synk 2022-05-16
  4. TUF Maintainer Panel DiscussionAndrew Krug, Datadog; Asra Ali, Google; Marina Moore, NYU; Trishank Karthik Kuppusamy, Datadog; & Jussi Kukkonen, VMware 2022-05-16
  5. Security Champions: The What, Why, and HowAnn Marie Fred, Red Hat 2022-05-16
  6. Protect the Pipe! A Policy-based Approach for Securing CI/CD PipelinesShripad Nadgowda, IBM Research & Jim Bugwadia, Nirmata 2022-05-16
  7. Fuzzing the CNCF LandscapeAdam Korczynski & David Korczynski, Ada Logics 2022-05-16
  8. Dissecting the Discovery of the 0-Day Supply Chain Vulnerability in Argo CDMoshe Zioni, Apiiro 2022-05-16
  9. CTF Overview and ExperienceLewis Denham-Parry, Control Plane 2022-05-16
  10. Vanquishing Vulnerabilities in ValenciaAlba Ferri Fitó, Sysdig & Eric Smalling, Synk 2022-05-17
  11. Towards the Hardened Cloud-Native Cornerstone: Container Runtime Protection from Security to PrivacyKailun Qin, Intel 2022-05-17
  12. Top 5 Reasons (and 5 Myths Debunked) to Invest in Securing the Software Supply ChainHector Linares, Microsoft 2022-05-17
  13. Shrinking Software Attack Surface with WebAssembly & CNCF WasmcloudLiam Randall, Cosmonic 2022-05-17
  14. Real Time Security - eBPF for Preventing attacksLiz Rice, Isovalent 2022-05-17
  15. Putting the Supply Chain Pieces together: A Deep Dive into the Secure software FactoryMichael Lieberman, Citi 2022-05-17
  16. Purple Teaming Like Sky’s the Limit – Adversary Emulation in the Cloud with Stratus Red TeamChristophe Tafani-Dereeper, Datadog 2022-05-17
  17. Deep Dive: Serverless Security (STAG Presentation)Andrew J Krug, Datadog; Ragashree M C, Nokia; Ashish Rajan, CISO & Ariel Shuper, Cisco 2022-05-17