Upgrade to Pro — share decks privately, control downloads, hide ads and more …

Securing your software supply chain

Avatar for Nicolas Byl Nicolas Byl
April 17, 2020
Technology
0
350

Securing your software supply chain

Avatar for Nicolas Byl

Nicolas Byl

April 17, 2020
Tweet

More Decks by Nicolas Byl

See All by Nicolas Byl
Die Flucht aus der Prototypen-Hölle
Avatar for Nicolas Byl nbyl
0
41
Lean Prototyping for Industrial-IoT Projects
Avatar for Nicolas Byl nbyl
0
38
DevSecOps - Vom Unikum zur gut geölten Maschine
Avatar for Nicolas Byl nbyl
0
89
Keeping-Up-WithUpstream.pdf
Avatar for Nicolas Byl nbyl
0
150
Dr. Kube und der Helm - Anatomie einer CD-Pipeline
Avatar for Nicolas Byl nbyl
0
110
Securing the "other" supply chain
Avatar for Nicolas Byl nbyl
0
250
Kubernetes - Auf die Cluster, Fertig, Los!
Avatar for Nicolas Byl nbyl
0
170
Helm - Kubernetes Deployments richtig gemacht
Avatar for Nicolas Byl nbyl
0
120
It's the developers, stupid!
Avatar for Nicolas Byl nbyl
0
180

Other Decks in Technology

See All in Technology
25分で解説する「最小権限の原則」を実現するための AWS「ポリシー」大全 / 20250625-aws-summit-aws-policy
Avatar for opelab opelab
9
1.2k
データプラットフォーム技術におけるメダリオンアーキテクチャという考え方/DataPlatformWithMedallionArchitecture
Avatar for Masatoshi Shimada smdmts
5
650
より良いプロダクトの開発を目指して - 情報を中心としたプロダクト開発 #phpcon #phpcon2025
Avatar for 弁護士ドットコム bengo4com
1
3.1k
TechLION vol.41～MySQLユーザ会のほうから来ました / techlion41_mysql
Avatar for sakaik sakaik
0
190
AWS テクニカルサポートとエンドカスタマーの中間地点から見えるより良いサポートの活用方法
Avatar for kazzpapa3 kazzpapa3
2
560
BrainPadプログラミングコンテスト記念LT会2025_社内イベント&問題解説
Avatar for BrainPad brainpadpr
1
170
Snowflake Summit 2025全体振り返り / Snowflake Summit 2025 Overall Review
Avatar for k.muguruma mtpooh
2
410
「Chatwork」の認証基盤の移行とログ活用によるプロダクト改善
Avatar for kubell kubell_hr
1
200
なぜ私はいま、ここにいるのか？ #もがく中堅デザイナー #プロダクトデザイナー
Avatar for 弁護士ドットコム bengo4com
0
480
Oracle Cloud Infrastructure：2025年6月度サービス・アップデート
Avatar for oracle4engineer oracle4engineer
PRO
2
270
"サービスチーム" での技術選定 / Making Technology Decisions for the Service Team
Avatar for 株式会社カミナシ kaminashi
1
170
mrubyと micro-ROSが繋ぐロボットの世界
Avatar for Katsuhiko Kageyama kishima
2
350

Featured

See All Featured
What’s in a name? Adding method to the madness
Avatar for Product Marketing Alliance productmarketing
PRO
23
3.5k
Making the Leap to Tech Lead
Avatar for Ryan Cromwell cromwellryan
134
9.4k
Building Flexible Design Systems
Avatar for Yesenia Perez-Cruz yeseniaperezcruz
328
39k
Why You Should Never Use an ORM
Avatar for John Nunemaker jnunemaker
PRO
58
9.4k
Practical Tips for Bootstrapping Information Extraction Pipelines
Avatar for Matthew Honnibal honnibal
PRO
20
1.3k
Building Applications with DynamoDB
Avatar for Matt Wood mza
95
6.5k
Stop Working from a Prison Cell
Avatar for Chris Michel hatefulcrawdad
270
20k
Faster Mobile Websites
Avatar for Dean Hume deanohume
307
31k
Raft: Consensus for Rubyists
Avatar for Patrick Van Stee vanstee
140
7k
Design and Strategy: How to Deal with People Who Don’t "Get" Design
Avatar for Morgane Peng morganepeng
130
19k
Build your cross-platform service in a week with App Engine
Avatar for Jose L jlugia
231
18k
Why Our Code Smells
Avatar for Brandon Keepers bkeepers
PRO
337
57k

Transcript

  1. Securing your software supply chain Anatomie einer DevSecOps Pipeline 1

  2. Storytime 2

  3. 3 The way of the Code

  4. The castle illusion 4

  5. 5 The way of the Code

  6. 6 The way of the Code

  7. Code reviews 7

  8. Signing git commits 8

  9. 9 The way of the Code

  10. The dependency iceberg 10

  11. Automation is king 11 • FindBugs • SonarQube • SAST/DAST

    • Maven, NPM, ... • Container Images • Operating System • npm audit • Dependabot • Renovate Source Code Analysis Dependency Analysis Update Automation

  12. 12 The way of the Code

  13. 13 The key to the kingdom

  14. 14 Current situation deploy

  15. 15 Zero-Trust Deployment IAM deploy poll

  16. 16 Policy trumps checks IAM deploy poll

  17. codecentric AG Kreuznacher Straße 30 60486 Frankfurt am Main Telefon:

    +49 (0) 173.731 02 40 Nicolas Byl Senior Cloud Consultant [email protected] www.codecentric.de Innovative - Trustful - Competent - Pragmatic 17