Upgrade to Pro — share decks privately, control downloads, hide ads and more …

Securing your software supply chain

Avatar for Nicolas Byl Nicolas Byl
April 17, 2020
Technology
390
0

Securing your software supply chain

Avatar for Nicolas Byl

Nicolas Byl

April 17, 2020

More Decks by Nicolas Byl

See All by Nicolas Byl
Platform Engineering ❤️ Developer Experience
Avatar for Nicolas Byl nbyl
0
50
Die Flucht aus der Prototypen-Hölle
Avatar for Nicolas Byl nbyl
0
55
Lean Prototyping for Industrial-IoT Projects
Avatar for Nicolas Byl nbyl
0
76
DevSecOps - Vom Unikum zur gut geölten Maschine
Avatar for Nicolas Byl nbyl
0
120
Keeping-Up-WithUpstream.pdf
Avatar for Nicolas Byl nbyl
0
190
Dr. Kube und der Helm - Anatomie einer CD-Pipeline
Avatar for Nicolas Byl nbyl
0
150
Securing the "other" supply chain
Avatar for Nicolas Byl nbyl
0
310
Kubernetes - Auf die Cluster, Fertig, Los!
Avatar for Nicolas Byl nbyl
0
220
Helm - Kubernetes Deployments richtig gemacht
Avatar for Nicolas Byl nbyl
0
150

Other Decks in Technology

See All in Technology
TypeScriptはどのようにどこまで推論できるのか ─ とにかく as は禁止で
Avatar for ypresto ypresto
1
290
GCASアップデート（202603-202605）
Avatar for 高橋広和 techniczna
0
240
"スキルファースト"で作る、AIの自走環境
Avatar for subroh_0508 subroh0508
1
660
LT準備のToilを削減 〜決定論×確率論のスライド生成CLI〜
Avatar for Shu Kobuchi shukob
0
120
業務に残された「良くない型」で考える「TypeScriptの難しさ」
Avatar for Saji sajikix
3
1k
SDDで⾒える、AIコーディングの"内訳"
Avatar for LINEヤフーTech (LY Corporation Tech) lycorptech_jp
PRO
0
140
TypeScriptで実現する既存APIを活用したリモートMCPサーバー構築 / TSKaigi 2026
Avatar for Shodai Suzuki soarteclab
1
180
Directions Asia 2026 | Beyond Buildable AI Agents: Let’s Visualize Partner Value in the AI Era
Avatar for Dynamics Ryo ryoheig0405
0
140
AIAgentと取り組むKaggle
Avatar for shuto goya 508shuto
2
470
実践 TanStack Start ― 新規プロダクトを開発して確立した、サーバーとクライアント境界の設計パターン / Practical TanStack Start Server-Client Boundary Patterns
Avatar for 株式会社カミナシ kaminashi
2
170
既存プロダクトQAから新規プロダクトQAへ
Avatar for hashi ryotakahashi
0
170
R&D 祭 2024 アニメエフェクト作成の効率化
Avatar for OLM Digital R&D olmdrd
PRO
0
110

Featured

See All Featured
Context Engineering - Making Every Token Count
Avatar for Addy Osmani addyosmani
9
890
VelocityConf: Rendering Performance Case Studies
Avatar for Addy Osmani addyosmani
333
25k
Art, The Web, and Tiny UX
Avatar for Lynn Fisher lynnandtonic
304
21k
The Illustrated Guide to Node.js - THAT Conference 2024
Avatar for David Neal reverentgeek
1
350
Claude Code のすすめ
Avatar for schroneko schroneko
67
220k
The Limits of Empathy - UXLibs8
Avatar for Cassini Nazir cassininazir
1
330
The Impact of AI in SEO - AI Overviews June 2024 Edition
Avatar for Aleyda Solis aleyda
5
1.1k
GraphQLとの向き合い方2022年版
Avatar for Yosuke Kurami quramy
50
15k
A designer walks into a library…
Avatar for Paul Jervis Heath pauljervisheath
211
24k
Why You Should Never Use an ORM
Avatar for John Nunemaker jnunemaker
PRO
61
9.8k
How Software Deployment tools have changed in the past 20 years
Avatar for Geshan Manandhar geshan
0
33k
Faster Mobile Websites
Avatar for Dean Hume deanohume
310
31k

Transcript

  1. Securing your software supply chain Anatomie einer DevSecOps Pipeline 1

  2. Storytime 2

  3. 3 The way of the Code

  4. The castle illusion 4

  5. 5 The way of the Code

  6. 6 The way of the Code

  7. Code reviews 7

  8. Signing git commits 8

  9. 9 The way of the Code

  10. The dependency iceberg 10

  11. Automation is king 11 • FindBugs • SonarQube • SAST/DAST

    • Maven, NPM, ... • Container Images • Operating System • npm audit • Dependabot • Renovate Source Code Analysis Dependency Analysis Update Automation

  12. 12 The way of the Code

  13. 13 The key to the kingdom

  14. 14 Current situation deploy

  15. 15 Zero-Trust Deployment IAM deploy poll

  16. 16 Policy trumps checks IAM deploy poll

  17. codecentric AG Kreuznacher Straße 30 60486 Frankfurt am Main Telefon:

    +49 (0) 173.731 02 40 Nicolas Byl Senior Cloud Consultant [email protected] www.codecentric.de Innovative - Trustful - Competent - Pragmatic 17