Fortify & Forget - Speaker Deck

Slide 1

Slide 1 text

Fortify & Forget Minder’s Approach to Simplifying Supply Chain Security

Slide 2

Slide 2 text

2 ©Stacklok, Inc 2024 Thank you!

Slide 3

Slide 3 text

Who am I? Juan Antonio “Ozz” Osorio Staff Security Beard 3 ©Stacklok, Inc 2024 Mexican living in Finland Talk to me about: ● Supply chain security ● Vulnerability management ● Cloud security ● Craft beer ● Running ● Heavy metal

Slide 4

Slide 4 text

Who are we? Stacklok est. May 2023 4 ©Stacklok, Inc 2024 We're passionate about making open source software safer. We help you ● Build safer software ● Make safer dependency choices ● Keep your software pipelines secure We aim to simplify supply chain security

Slide 5

Slide 5 text

How? Trusty Package trust scoring Minder Today’s talk 5 ©Stacklok, Inc 2024

Slide 6

Slide 6 text

Agenda ● Why? ● What? ● How? ● Huh?... Demo time! ● What’s next? ● How you can help! 6 ©Stacklok, Inc 2024 Minder

Slide 7

Slide 7 text

This is f*cking hard! Anybody dealing with supply chain security… probably… 7 ©Stacklok, Inc 2024

Slide 8

Slide 8 text

Supply chain security buzzwords ● Dependency management ● Repository (VCS) security ● SBOMs ● Attestations ● Image signatures 8 ©Stacklok, Inc 2024 Why?

Slide 9

Slide 9 text

Supply chain security puzzle ● Scorecards ● Sigstore ● in-toto ● CycloneDX ● SLSA ● VEX 9 ©Stacklok, Inc 2024 Why?

Slide 10

Slide 10 text

Minder to the rescue! 10 ©Stacklok, Inc 2024 ● Automate repository security settings ● Enforce best-practices ● Track packages from your repositories ● Protect against vulnerable dependencies ● Automatic remediations/fixes ● Multi-tenant

Slide 11

Slide 11 text

Minder to the rescue! 11 ©Stacklok, Inc 2024 ● Automate repository security settings ● Enforce best-practices ● Track packages from your repositories ● Protect against vulnerable dependencies ● Automatic remediations/fixes ● Multi-tenant ● It’s open source!

Slide 12

Slide 12 text

Minder to the rescue! 12 ©Stacklok, Inc 2024 ● Automate repository security settings ● Enforce best-practices ● Track packages from your repositories ● Protect against vulnerable dependencies ● Automatic remediations/fixes ● Multi-tenant ● It’s open source! ● Available as a service!

Slide 13

Slide 13 text

Concepts 13 ©Stacklok, Inc 2024 What? Providers Repositories Pull requests Artifacts

Slide 14

Slide 14 text

Policies --- version: v1 type: profile name: stacklok-github-profile context: provider: github alert: "off" remediate: "off" repository: - type: secret_scanning def: enabled: true skip_private_repos : true artifact: ... pull_request : ... 14 ©Stacklok, Inc 2024 What?

Slide 15

Slide 15 text

Policies --- version: v1 type: profile name: stacklok-github-profile context: provider: github alert: "off" remediate: "off" repository: ... artifact: - type: artifact_signature params: tags: [latest] name: minder/server def: is_signed: true is_verified : true is_bundle_verified : true pull_request : ... 15 ©Stacklok, Inc 2024 What?

Slide 16

Slide 16 text

Minder ● Rules are pluggable and extensible. ○ You can write your own! ● We aim to track and map the different aspects of the supply chain, not just repositories. 16 ©Stacklok, Inc 2024 What?

Slide 17

Slide 17 text

Slide 18

Slide 18 text

Internals speedrun ● Learning from k8s: Level vs edge triggering ○ Events and reconciliations ● Deploy on k8s but keep state out of it ● State is tracked in Postgres not etcd ● Identity is kept outside entirely ○ OIDC via Keycloak ● Package verifications and attestations handled via Sigstore 18 ©Stacklok, Inc 2024 How?

Slide 19

Slide 19 text

Slide 20

Slide 20 text

Roadmap ● Way more rules! ● A shiny UI ● Build environment attestations ● Workload mapping ● Hierarchical multi-tenancy ● Re-vamped authorization engine (OpenFGA-based) 20 ©Stacklok, Inc 2024 What’s next?

Slide 21

Slide 21 text

Minder is OSS ● Try it out! ○ We have a running production instance ● Check it out! ○ https://github.com/stacklok/minder ● Give us feedback! ○ You can issue a GitHub issue or even talk to us on Discord ● Document or code! ○ We’re happy to review 21 ©Stacklok, Inc 2024 How you can help!