Upgrade to Pro — share decks privately, control downloads, hide ads and more …

Securing your software supply chain

Avatar for Nicolas Byl Nicolas Byl
April 17, 2020
Technology
0
360

Securing your software supply chain

Avatar for Nicolas Byl

Nicolas Byl

April 17, 2020
Tweet

More Decks by Nicolas Byl

See All by Nicolas Byl
Die Flucht aus der Prototypen-Hölle
Avatar for Nicolas Byl nbyl
0
43
Lean Prototyping for Industrial-IoT Projects
Avatar for Nicolas Byl nbyl
0
40
DevSecOps - Vom Unikum zur gut geölten Maschine
Avatar for Nicolas Byl nbyl
0
97
Keeping-Up-WithUpstream.pdf
Avatar for Nicolas Byl nbyl
0
160
Dr. Kube und der Helm - Anatomie einer CD-Pipeline
Avatar for Nicolas Byl nbyl
0
120
Securing the "other" supply chain
Avatar for Nicolas Byl nbyl
0
270
Kubernetes - Auf die Cluster, Fertig, Los!
Avatar for Nicolas Byl nbyl
0
180
Helm - Kubernetes Deployments richtig gemacht
Avatar for Nicolas Byl nbyl
0
120
It's the developers, stupid!
Avatar for Nicolas Byl nbyl
0
190

Other Decks in Technology

See All in Technology
自作JSエンジンに推しプロポーザルを実装したい！
Avatar for Saji sajikix
1
170
ZOZOマッチのアーキテクチャと技術構成
Avatar for ZOZO Developers zozotech
PRO
3
1.5k
Autonomous Database - Dedicated 技術詳細 / adb-d_technical_detail_jp
Avatar for oracle4engineer oracle4engineer
PRO
4
10k
Rustから学ぶ 非同期処理の仕組み
Avatar for skanehira skanehira
1
130
機械学習を扱うプラットフォーム開発と運用事例
Avatar for LINEヤフーTech (LY Corporation Tech) lycorptech_jp
PRO
0
230
会社紹介資料 / Sansan Company Profile
Avatar for Sansan, Inc. sansan33
PRO
6
380k
共有と分離 - Compose Multiplatform "本番導入" の設計指針
Avatar for Ryo WATANABE error96num
2
410
allow_retry と Arel.sql / allow_retry and Arel.sql
Avatar for Shintani Teppei euglena1215
1
160
Automating Web Accessibility Testing with AI Agents
Avatar for South maminami373
0
1.3k
LLMを搭載したプロダクトの品質保証の模索と学び
Avatar for SmartHR 品質保証部 qa
0
1k
Firestore → Spanner 移行 を成功させた段階的移行プロセス
Avatar for a-thug athug
1
470
2つのフロントエンドと状態管理
Avatar for MIXI ENGINEERS mixi_engineers
PRO
3
100

Featured

See All Featured
CoffeeScript is Beautiful & I Never Want to Write Plain JavaScript Again
Avatar for Sam Stephenson sstephenson
162
15k
How STYLIGHT went responsive
Avatar for nonsquared nonsquared
100
5.8k
jQuery: Nuts, Bolts and Bling
Avatar for Doug Neiner dougneiner
64
7.9k
実際に使うSQLの書き方 徹底解説 / pgcon21j-tutorial
Avatar for soudai sone soudai
PRO
188
55k
The Straight Up "How To Draw Better" Workshop
Avatar for Dennis Kardys denniskardys
236
140k
[RailsConf 2023] Rails as a piece of cake
Avatar for Vladimir Dementyev palkan
57
5.8k
Easily Structure & Communicate Ideas using Wireframe
Avatar for Afnizar Nur Ghifari afnizarnur
194
16k
VelocityConf: Rendering Performance Case Studies
Avatar for Addy Osmani addyosmani
332
24k
YesSQL, Process and Tooling at Scale
Avatar for Rocio Delgado rocio
173
14k
Large-scale JavaScript Application Architecture
Avatar for Addy Osmani addyosmani
512
110k
The Art of Delivering Value - GDevCon NA Keynote
Avatar for David Neal reverentgeek
15
1.6k
Responsive Adventures: Dirty Tricks From The Dark Corners of Front-End
Avatar for Vitaly Friedman smashingmag
252
21k

Transcript

  1. Securing your software supply chain Anatomie einer DevSecOps Pipeline 1

  2. Storytime 2

  3. 3 The way of the Code

  4. The castle illusion 4

  5. 5 The way of the Code

  6. 6 The way of the Code

  7. Code reviews 7

  8. Signing git commits 8

  9. 9 The way of the Code

  10. The dependency iceberg 10

  11. Automation is king 11 • FindBugs • SonarQube • SAST/DAST

    • Maven, NPM, ... • Container Images • Operating System • npm audit • Dependabot • Renovate Source Code Analysis Dependency Analysis Update Automation

  12. 12 The way of the Code

  13. 13 The key to the kingdom

  14. 14 Current situation deploy

  15. 15 Zero-Trust Deployment IAM deploy poll

  16. 16 Policy trumps checks IAM deploy poll

  17. codecentric AG Kreuznacher Straße 30 60486 Frankfurt am Main Telefon:

    +49 (0) 173.731 02 40 Nicolas Byl Senior Cloud Consultant [email protected] www.codecentric.de Innovative - Trustful - Competent - Pragmatic 17