Upgrade to Pro — share decks privately, control downloads, hide ads and more …

Securing your software supply chain

Sponsored · Your Podcast. Everywhere. Effortlessly. Share. Educate. Inspire. Entertain. You do you. We'll handle the rest. →
Avatar for Nicolas Byl Nicolas Byl
April 17, 2020
Technology
400
0

Securing your software supply chain

Avatar for Nicolas Byl

Nicolas Byl

April 17, 2020

More Decks by Nicolas Byl

See All by Nicolas Byl
Platform Engineering ❤️ Developer Experience
Avatar for Nicolas Byl nbyl
0
62
Die Flucht aus der Prototypen-Hölle
Avatar for Nicolas Byl nbyl
0
61
Lean Prototyping for Industrial-IoT Projects
Avatar for Nicolas Byl nbyl
0
77
DevSecOps - Vom Unikum zur gut geölten Maschine
Avatar for Nicolas Byl nbyl
0
120
Keeping-Up-WithUpstream.pdf
Avatar for Nicolas Byl nbyl
0
200
Dr. Kube und der Helm - Anatomie einer CD-Pipeline
Avatar for Nicolas Byl nbyl
0
160
Securing the "other" supply chain
Avatar for Nicolas Byl nbyl
0
330
Kubernetes - Auf die Cluster, Fertig, Los!
Avatar for Nicolas Byl nbyl
0
220
Helm - Kubernetes Deployments richtig gemacht
Avatar for Nicolas Byl nbyl
0
150

Other Decks in Technology

See All in Technology
Bits Agent Builder の⼊⾨と活⽤事例
Avatar for 株式会社ヌーラボ nulabinc
PRO
0
190
Agent 時代の Kaggle 展望 / kaggle-in-the-agentic-era
Avatar for Shotaro Ishihara upura
1
810
【CEDEC2026】コードレビュー支援ツール開発から学ぶ：LLMを用いた業務システムの実践的な運用設計と誤出力対策
Avatar for Cygames, Inc. cygames
PRO
0
850
LanceDB入門
Avatar for Tomoko Uchida mocobeta
8
590
システム思考で問題に対処する
Avatar for yussak yussak
0
330
QAエンジニア起点で進める、SmartHRにおける信頼性向上について
Avatar for kaomi kaomi_wombat
1
150
自宅NWにISR4331を導入してみた話
Avatar for okaits#7534 okaits
0
110
え？フロントエンドエンジニアの ワイがインフラも！？
Avatar for puku0x puku0x
1
730
Genie Codeハンズオン応用編
Avatar for Takaaki Yayoi taka_aki
0
120
JavaScript 研修 (2026)
Avatar for Recruit recruitengineers
PRO
2
620
【GCC2026】大規模言語モデルを活用した内製検索サービスの社内展開や業務活用
Avatar for Bandai Namco Studios Inc. bandainamcostudios
PRO
0
220
Webアクセシビリティ入門 2026
Avatar for Recruit recruitengineers
PRO
3
650

Featured

See All Featured
First, design no harm
Avatar for Per Axbom axbom
PRO
2
1.2k
The Hidden Cost of Media on the Web [PixelPalooza 2025]
Avatar for Tammy Everts tammyeverts
2
470
Practical Tips for Bootstrapping Information Extraction Pipelines
Avatar for Matthew Honnibal honnibal
25
2k
Evolving SEO for Evolving Search Engines
Avatar for Ryan Jones ryanjones
0
260
Breaking role norms: Why Content Design is so much more than writing copy - Taylor Woolridge
Avatar for UX Y'all uxyall
0
370
Let's Do A Bunch of Simple Stuff to Make Websites Faster
Avatar for Chris Coyier chriscoyier
508
140k
Un-Boring Meetings
Avatar for Sebastian Deterding codingconduct
0
390
Sam Torres - BigQuery for SEOs
Avatar for Tech SEO Connect techseoconnect
PRO
0
500
Understanding Cognitive Biases in Performance Measurement
Avatar for Philip Tellis bluesmoon
32
3k
svc-hook: hooking system calls on ARM64 by binary rewriting
Avatar for Akira Moroo retrage
2
490
YesSQL, Process and Tooling at Scale
Avatar for Rocio Delgado rocio
174
15k
Effective software design: The role of men in debugging patriarchy in IT @ Voxxed Days AMS
Avatar for Kenny Baas-Schwegler baasie
0
480

Transcript

  1. Securing your software supply chain Anatomie einer DevSecOps Pipeline 1

  2. Storytime 2

  3. 3 The way of the Code

  4. The castle illusion 4

  5. 5 The way of the Code

  6. 6 The way of the Code

  7. Code reviews 7

  8. Signing git commits 8

  9. 9 The way of the Code

  10. The dependency iceberg 10

  11. Automation is king 11 • FindBugs • SonarQube • SAST/DAST

    • Maven, NPM, ... • Container Images • Operating System • npm audit • Dependabot • Renovate Source Code Analysis Dependency Analysis Update Automation

  12. 12 The way of the Code

  13. 13 The key to the kingdom

  14. 14 Current situation deploy

  15. 15 Zero-Trust Deployment IAM deploy poll

  16. 16 Policy trumps checks IAM deploy poll

  17. codecentric AG Kreuznacher Straße 30 60486 Frankfurt am Main Telefon:

    +49 (0) 173.731 02 40 Nicolas Byl Senior Cloud Consultant [email protected] www.codecentric.de Innovative - Trustful - Competent - Pragmatic 17