Edition 01

Supply Chain Security

Name: Supply Chain Security
Start: 2024-07-16T09:30:00+02:00
End: 2024-07-16T13:00:00+02:00

The first Talks On My Machine, on software supply chain security: GUAC, Sigstore and SBOM, Terraform and Kyverno, with OpenSSF experts.

The event.

This event has ended

July 16, 2024 · Online

Attacks that come in through dependencies and build tools are more and more frequent: SolarWinds, Log4Shell and Codecov are the best-known examples.

With this event Talks On My Machine opened its series. We covered:

The most common vulnerabilities: the most exposed areas of the supply chain and emerging threats
Mitigation strategies: effective security controls and the technologies that automate them
Cases and experience: practical examples and advice from industry experts and OpenSSF members

Four talks and audience questions, from 9:30 to 13:00.

9:30–9:45
Introduction
SparkFabrik
Opening and welcome
9:45–10:30
Supply Chain Security: A Sandwich that goes well with GUAC
Michael Lieberman
The importance of supply chain security and the suite of tools that compose the solution, including the GUAC project for software supply chain transparency and observability.
10:30–11:15
Building a Trusted and Resilient Software Supply Chain
Paolo Mainardi
Current state of the Software Supply Chain, significant global events (SolarWinds, log4shell, codecov), and tools like Sigstore, Syft, and Grype for digital signatures and SBOM.
11:15–12:00
Protecting Terraform-based Infrastructure from Threats
Andrea Panisson
Analysis of Terraform’s internal workings, common attacks, and critical security aspects for infrastructure as code.
12:00–12:45
Unleash Kyverno: Building a Trusted and Resilient Supply Chain on Kubernetes
Giuseppe Arancio
Kyverno as a policy engine for Kubernetes: OCI image validation, SBOM generation, and integration with CI/CD pipelines.
12:45–12:55
Q&A and Closing
SparkFabrik
Questions and answers with speakers

Who spoke at the event.

Michael LiebermanCo-founder and CTO, Kusari
Talk
Supply Chain Security: A Sandwich that goes well with GUAC
Talk detailsClose
Talk in English, pre-recorded
Paolo MainardiCo-founder and CTO, SparkFabrik
Talk
Building a Trusted and Resilient Software Supply Chain
Talk detailsClose
Pre-recorded talk
Andrea PanissonCloud-Native Engineer, SparkFabrik
Talk
Protecting Terraform-based Infrastructure from Threats
Giuseppe ArancioCloud-Native Engineer, SparkFabrik
Talk
Unleash Kyverno: Building a Trusted and Resilient Supply Chain on Kubernetes
Edoardo DusiDevRel, event MC, SparkFabrik