Upgrade to Pro — share decks privately, control downloads, hide ads and more …

Securing your software supply chain

Avatar for Nicolas Byl Nicolas Byl
April 17, 2020
Technology
0
360

Securing your software supply chain

Avatar for Nicolas Byl

Nicolas Byl

April 17, 2020
Tweet

More Decks by Nicolas Byl

See All by Nicolas Byl
Die Flucht aus der Prototypen-Hölle
Avatar for Nicolas Byl nbyl
0
41
Lean Prototyping for Industrial-IoT Projects
Avatar for Nicolas Byl nbyl
0
38
DevSecOps - Vom Unikum zur gut geölten Maschine
Avatar for Nicolas Byl nbyl
0
92
Keeping-Up-WithUpstream.pdf
Avatar for Nicolas Byl nbyl
0
150
Dr. Kube und der Helm - Anatomie einer CD-Pipeline
Avatar for Nicolas Byl nbyl
0
110
Securing the "other" supply chain
Avatar for Nicolas Byl nbyl
0
250
Kubernetes - Auf die Cluster, Fertig, Los!
Avatar for Nicolas Byl nbyl
0
170
Helm - Kubernetes Deployments richtig gemacht
Avatar for Nicolas Byl nbyl
0
120
It's the developers, stupid!
Avatar for Nicolas Byl nbyl
0
180

Other Decks in Technology

See All in Technology
AI工学特論: MLOps・継続的評価
Avatar for Asei Sugiyama asei
10
2k
ML Pipelineの開発と運用を OpenTelemetryで繋ぐ @ OpenTelemetry Meetup 2025-07
Avatar for Yoshimura Naoya getty708
0
320
MCPに潜むセキュリティリスクを考えてみる
Avatar for Milix-M milix_m
1
870
ecspressoの設計思想に至る道 / sekkeinight2025
Avatar for FUJIWARA Shunichiro fujiwara3
12
2.1k
データエンジニアがクラシルでやりたいことの現在地
Avatar for harry gappy50
3
660
Railsの限界を超えろ！「家族アルバム みてね」の画像・動画の大規模アップロードを支えるアーキテクチャの変遷
Avatar for Ojima Hikaru ojima_h
4
520
From Live Coding to Vibe Coding with Firebase Studio
Avatar for Firebase Thailand firebasethailand
1
310
機械学習を「社会実装」するということ 2025年夏版 / Social Implementation of Machine Learning July 2025 Version
Avatar for Moe Uchiike（内池 もえ） moepy_stats
1
1.4k
RapidPen: AIエージェントによる高度なペネトレーションテスト自動化の研究開発
Avatar for Sho Nakatani laysakura
1
410
モバイルゲームの開発を支える基盤の歩み ～再現性のある開発ラインを量産する秘訣～
Avatar for QualiArts qualiarts
0
610
スプリントレビューを効果的にするために
Avatar for Miho Nagase miholovesq
9
1.7k
隙間時間で爆速開発！ Claude Code × Vibe Coding で作るマニュアル自動生成サービス
Avatar for Akitomo Sato akitomonam
2
200

Featured

See All Featured
Building Adaptive Systems
Avatar for Chris Keathley keathley
43
2.7k
4 Signs Your Business is Dying
Avatar for Josh Pigford shpigford
184
22k
The Success of Rails: Ensuring Growth for the Next 100 Years
Avatar for Eileen M. Uchitelle eileencodes
45
7.5k
A Tale of Four Properties
Avatar for Chris Coyier chriscoyier
160
23k
The Power of CSS Pseudo Elements
Avatar for Geoffrey Crofte geoffreycrofte
77
5.9k
Typedesign – Prime Four
Avatar for Hannes Fritz hannesfritz
42
2.7k
Fantastic passwords and where to find them - at NoRuKo
Avatar for Phil Nash philnash
51
3.3k
A better future with KSS
Avatar for Kyle Neath kneath
238
17k
Making the Leap to Tech Lead
Avatar for Ryan Cromwell cromwellryan
134
9.4k
Embracing the Ebb and Flow
Avatar for Simon Collison colly
86
4.8k
Principles of Awesome APIs and How to Build Them.
Avatar for Keavy McMinn keavy
126
17k
Keith and Marios Guide to Fast Websites
Avatar for Keith Pitt keithpitt
411
22k

Transcript

  1. Securing your software supply chain Anatomie einer DevSecOps Pipeline 1

  2. Storytime 2

  3. 3 The way of the Code

  4. The castle illusion 4

  5. 5 The way of the Code

  6. 6 The way of the Code

  7. Code reviews 7

  8. Signing git commits 8

  9. 9 The way of the Code

  10. The dependency iceberg 10

  11. Automation is king 11 • FindBugs • SonarQube • SAST/DAST

    • Maven, NPM, ... • Container Images • Operating System • npm audit • Dependabot • Renovate Source Code Analysis Dependency Analysis Update Automation

  12. 12 The way of the Code

  13. 13 The key to the kingdom

  14. 14 Current situation deploy

  15. 15 Zero-Trust Deployment IAM deploy poll

  16. 16 Policy trumps checks IAM deploy poll

  17. codecentric AG Kreuznacher Straße 30 60486 Frankfurt am Main Telefon:

    +49 (0) 173.731 02 40 Nicolas Byl Senior Cloud Consultant [email protected] www.codecentric.de Innovative - Trustful - Competent - Pragmatic 17