Upgrade to Pro — share decks privately, control downloads, hide ads and more …

Securing your software supply chain

Sponsored · SiteGround - Reliable hosting with speed, security, and support you can count on. →
Avatar for Nicolas Byl Nicolas Byl
April 17, 2020
Technology
0
380

Securing your software supply chain

Avatar for Nicolas Byl

Nicolas Byl

April 17, 2020
Tweet

More Decks by Nicolas Byl

See All by Nicolas Byl
Platform Engineering ❤️ Developer Experience
Avatar for Nicolas Byl nbyl
0
34
Die Flucht aus der Prototypen-Hölle
Avatar for Nicolas Byl nbyl
0
50
Lean Prototyping for Industrial-IoT Projects
Avatar for Nicolas Byl nbyl
0
69
DevSecOps - Vom Unikum zur gut geölten Maschine
Avatar for Nicolas Byl nbyl
0
110
Keeping-Up-WithUpstream.pdf
Avatar for Nicolas Byl nbyl
0
180
Dr. Kube und der Helm - Anatomie einer CD-Pipeline
Avatar for Nicolas Byl nbyl
0
140
Securing the "other" supply chain
Avatar for Nicolas Byl nbyl
0
300
Kubernetes - Auf die Cluster, Fertig, Los!
Avatar for Nicolas Byl nbyl
0
200
Helm - Kubernetes Deployments richtig gemacht
Avatar for Nicolas Byl nbyl
0
140

Other Decks in Technology

See All in Technology
Datadog Cloud Cost Management で実現するFinOps
Avatar for Taiji HAGINO taiponrock
PRO
0
130
トラブルの大半は「言ってない」x「言ってない」じゃねーか！！
Avatar for nakamichi ichimichi
0
300
Snowflake Night #2 LT
Avatar for タロウ taromatsui_cccmkhd
0
320
AI が Approve する開発フロー / How AI Reviewers Accelerate Our Development
Avatar for Hiroka Zaitsu zaimy
1
260
LY Tableauでの Tableau x AIの実践 (at Tableau Now! - 2026-02-26)
Avatar for Yoshitaka Arakawa yoshitakaarakawa
0
1.2k
フルカイテン株式会社 エンジニア向け採用資料
Avatar for FULL KAITEN fullkaiten
0
10k
Sansan Engineering Unit 紹介資料
Avatar for Sansan, Inc. sansan33
PRO
1
4k
ブラックボックス観測に基づくAI支援のプロトコルのリバースエンジニアリングと再現 ~AIを用いたリバースエンジニアリング~ @ SECCON 14 電脳会議 / Reverse Engineering and Reproduction of an AI-Assisted Protocol Based on Black-Box Observation @ SECCON 14 DENNO-KAIGI
Avatar for chibiegg chibiegg
0
130
Eight Engineering Unit 紹介資料
Avatar for Sansan, Inc. sansan33
PRO
1
6.9k
What's new in Go 1.26?
Avatar for Koya IWAMURA ciarana
2
280
Windows ネットワークを再確認する
Avatar for Murachi Akira murachiakira
PRO
0
250
Security Diaries of an Open Source IAM
Avatar for Alexander Schwartz ahus1
0
190

Featured

See All Featured
The Curious Case for Waylosing
Avatar for Cassini Nazir cassininazir
0
260
Building Applications with DynamoDB
Avatar for Matt Wood mza
96
6.9k
The Pragmatic Product Professional
Avatar for Laura Van Doore lauravandoore
37
7.2k
Large-scale JavaScript Application Architecture
Avatar for Addy Osmani addyosmani
515
110k
How To Speak Unicorn (iThemes Webinar)
Avatar for Michelle Schulp Hunt marktimemedia
1
400
Automating Front-end Workflow
Avatar for Addy Osmani addyosmani
1370
200k
Creating an realtime collaboration tool: Agile Flush - .NET Oxford
Avatar for Marc Duiker marcduiker
35
2.4k
The World Runs on Bad Software
Avatar for Brandon Keepers bkeepers
PRO
72
12k
The Language of Interfaces
Avatar for Des Traynor destraynor
162
26k
GraphQLとの向き合い方2022年版
Avatar for Yosuke Kurami quramy
50
14k
The Cost Of JavaScript in 2023
Avatar for Addy Osmani addyosmani
55
9.7k
What does AI have to do with Human Rights?
Avatar for Per Axbom axbom
PRO
1
2k

Transcript

  1. Securing your software supply chain Anatomie einer DevSecOps Pipeline 1

  2. Storytime 2

  3. 3 The way of the Code

  4. The castle illusion 4

  5. 5 The way of the Code

  6. 6 The way of the Code

  7. Code reviews 7

  8. Signing git commits 8

  9. 9 The way of the Code

  10. The dependency iceberg 10

  11. Automation is king 11 • FindBugs • SonarQube • SAST/DAST

    • Maven, NPM, ... • Container Images • Operating System • npm audit • Dependabot • Renovate Source Code Analysis Dependency Analysis Update Automation

  12. 12 The way of the Code

  13. 13 The key to the kingdom

  14. 14 Current situation deploy

  15. 15 Zero-Trust Deployment IAM deploy poll

  16. 16 Policy trumps checks IAM deploy poll

  17. codecentric AG Kreuznacher Straße 30 60486 Frankfurt am Main Telefon:

    +49 (0) 173.731 02 40 Nicolas Byl Senior Cloud Consultant [email protected] www.codecentric.de Innovative - Trustful - Competent - Pragmatic 17