Securing your software supply chain

Transcript

1. Securing your software supply chain Anatomie einer DevSecOps Pipeline 1
2. Storytime 2
3. 3 The way of the Code
4. The castle illusion 4
5. 5 The way of the Code
6. 6 The way of the Code
7. Code reviews 7
8. Signing git commits 8
9. 9 The way of the Code
10. The dependency iceberg 10
11. Automation is king 11 • FindBugs • SonarQube • SAST/DAST • Maven, NPM, ... • Container Images • Operating System • npm audit • Dependabot • Renovate Source Code Analysis Dependency Analysis Update Automation
12. 12 The way of the Code
13. 13 The key to the kingdom
14. 14 Current situation deploy
15. 15 Zero-Trust Deployment IAM deploy poll
16. 16 Policy trumps checks IAM deploy poll
17. codecentric AG Kreuznacher Straße 30 60486 Frankfurt am Main Telefon: +49 (0) 173.731 02 40 Nicolas Byl Senior Cloud Consultant nicolas.byl@codecentric.de www.codecentric.de Innovative - Trustful - Competent - Pragmatic 17