Upgrade to Pro — share decks privately, control downloads, hide ads and more …

Securing your software supply chain

Avatar for Nicolas Byl Nicolas Byl
April 17, 2020
Technology
400
0

Securing your software supply chain

Avatar for Nicolas Byl

Nicolas Byl

April 17, 2020

More Decks by Nicolas Byl

See All by Nicolas Byl
Platform Engineering ❤️ Developer Experience
Avatar for Nicolas Byl nbyl
0
57
Die Flucht aus der Prototypen-Hölle
Avatar for Nicolas Byl nbyl
0
57
Lean Prototyping for Industrial-IoT Projects
Avatar for Nicolas Byl nbyl
0
76
DevSecOps - Vom Unikum zur gut geölten Maschine
Avatar for Nicolas Byl nbyl
0
120
Keeping-Up-WithUpstream.pdf
Avatar for Nicolas Byl nbyl
0
190
Dr. Kube und der Helm - Anatomie einer CD-Pipeline
Avatar for Nicolas Byl nbyl
0
150
Securing the "other" supply chain
Avatar for Nicolas Byl nbyl
0
320
Kubernetes - Auf die Cluster, Fertig, Los!
Avatar for Nicolas Byl nbyl
0
220
Helm - Kubernetes Deployments richtig gemacht
Avatar for Nicolas Byl nbyl
0
150

Other Decks in Technology

See All in Technology
CIで使うClaude
Avatar for TomoyaIwata iwatatomoya
0
290
AIと共生する開発者プラットフォーム：バクラクのモノレポ×マイクロサービス基盤
Avatar for sakajunquality sakajunquality
2
3.7k
End-to-Endで考える信頼性 — LINEアプリにおける クライアント開発×SRE連携の実践
Avatar for maru maruloop
4
4.5k
脱金融のフューチャー・デザイン / Future Design Beyond Finance
Avatar for Kenji Saito ks91
PRO
0
160
CSに"SLO"は要らない、経営層に"99.9%"は伝わらない - SREを全社に"翻訳"する3原則
Avatar for サイバーセキュリティクラウド cscengineer
PRO
1
5k
タスクの複雑さでモデルを選ぶ ── Thompson Samplingで動かす“トークン/コスト最適化
Avatar for satoh-y-0323 satohy0323
0
550
Terraform共通モジュールをチーム横断で“変えられる”運用へ ― リリースと適用の分離
Avatar for kekke-n kekke_n
1
3.3k
AmplifyHostingConstructからSSRフレームワークのためのホスティング設計を考察する/amplify-hosting-construct
Avatar for MURAKAMI Masahiko fossamagna
1
210
そのドキュメント、自動化しませんか？
Avatar for yuk yuksew
1
290
SREとQA　二人三脚で進めるSLO運用/sre-qa-slo
Avatar for sugitak sugitak
0
820
世界、断片、モデル。そして理解
Avatar for SAKO Hiroshi ardbeg1958
1
130
AIが実装を自走する時代の認知負債との戦い
Avatar for LINEヤフーTech (LY Corporation Tech) lycorptech_jp
PRO
0
130

Featured

See All Featured
Exploring the Power of Turbo Streams & Action Cable | RailsConf2023
Avatar for Kevin Liebholz kevinliebholz
37
6.5k
Why Mistakes Are the Best Teachers: Turning Failure into a Pathway for Growth
Avatar for Umar Saidu Auna auna
0
180
Measuring Dark Social's Impact On Conversion and Attribution
Avatar for Stephen Akadiri stephenakadiri
2
240
Claude Code のすすめ
Avatar for schroneko schroneko
67
230k
How to Think Like a Performance Engineer
Avatar for Harry Roberts csswizardry
28
2.7k
Responsive Adventures: Dirty Tricks From The Dark Corners of Front-End
Avatar for Vitaly Friedman smashingmag
254
22k
How to audit for AI Accessibility on your Front & Back End
Avatar for davetheseo davetheseo
0
470
The Illustrated Children's Guide to Kubernetes
Avatar for Chris Short chrisshort
51
53k
RailsConf & Balkan Ruby 2019: The Past, Present, and Future of Rails at GitHub
Avatar for Eileen M. Uchitelle eileencodes
141
35k
The Success of Rails: Ensuring Growth for the Next 100 Years
Avatar for Eileen M. Uchitelle eileencodes
47
8.2k
HDC tutorial
Avatar for Michiel Stock michielstock
2
740
GitHub's CSS Performance
Avatar for Jon Rohan jonrohan
1033
470k

Transcript

  1. Securing your software supply chain Anatomie einer DevSecOps Pipeline 1

  2. Storytime 2

  3. 3 The way of the Code

  4. The castle illusion 4

  5. 5 The way of the Code

  6. 6 The way of the Code

  7. Code reviews 7

  8. Signing git commits 8

  9. 9 The way of the Code

  10. The dependency iceberg 10

  11. Automation is king 11 • FindBugs • SonarQube • SAST/DAST

    • Maven, NPM, ... • Container Images • Operating System • npm audit • Dependabot • Renovate Source Code Analysis Dependency Analysis Update Automation

  12. 12 The way of the Code

  13. 13 The key to the kingdom

  14. 14 Current situation deploy

  15. 15 Zero-Trust Deployment IAM deploy poll

  16. 16 Policy trumps checks IAM deploy poll

  17. codecentric AG Kreuznacher Straße 30 60486 Frankfurt am Main Telefon:

    +49 (0) 173.731 02 40 Nicolas Byl Senior Cloud Consultant [email protected] www.codecentric.de Innovative - Trustful - Competent - Pragmatic 17