Share
Embed
Slide 1
Slide 1 text
Securing the Software Supply Chain without Slowing Down
What’s in your Container?
Adrian Kosmaczewski
Senior Architect
Red Hat
Slide 2
Slide 2 text
Adrian Kosmaczewski
Senior Architect
Red Hat
Slide 3
Slide 3 text
Act 1
The "Black Box" Problem
Slide 4
Slide 4 text
4
Slide 5
Slide 5 text
5
Slide 6
Slide 6 text
Software is assembled,
not written
Slide 7
Slide 7 text
https://static.carahsoft.com/concrete/files/1617/1597/8665/2024_Open_Source_Security_and_Risk_Analysis_Report_WRAPPED.pdf
Slide 8
Slide 8 text
Speed
Slide 9
Slide 9 text
“Typosquatting”
“requessts”
Slide 10
Slide 10 text
No content
Slide 11
Slide 11 text
No content
Slide 12
Slide 12 text
Do you know what is running in
your infrastructure?
Slide 13
Slide 13 text
We need the digital equivalent
of a nutrition label
Slide 14
Slide 14 text
Act 2
The Three Pillars
Slide 15
Slide 15 text
15
Slide 16
Slide 16 text
Transparency, Identity, and
Guardrails
Slide 17
Slide 17 text
1. Transparency
Slide 18
Slide 18 text
SBOM
Slide 19
Slide 19 text
(Software Bill of Materials)
Slide 20
Slide 20 text
https://github.com/anchore/syft
Slide 21
Slide 21 text
https://developers.redhat.com/products/trusted-profile-analyzer
Slide 22
Slide 22 text
22
https://github.com/CycloneDX/bom-examples/blob/master/SBOM/keycloak-10.0.2/bom.json
Slide 23
Slide 23 text
2. Identity
Slide 24
Slide 24 text
No content
Slide 25
Slide 25 text
No content
Slide 26
Slide 26 text
26
https://www.sigstore.dev/
Slide 27
Slide 27 text
https://developers.redhat.com/products/trusted-artifact-signer
Slide 28
Slide 28 text
No content
Slide 29
Slide 29 text
No content
Slide 30
Slide 30 text
3. Guardrails
Slide 31
Slide 31 text
No content
Slide 32
Slide 32 text
https://www.redhat.com/en/technologies/cloud-computing/openshift/advanced-cluster-security-kubernetes
Slide 33
Slide 33 text
Container built on developer
laptop?
Slide 34
Slide 34 text
No content
Slide 35
Slide 35 text
Container signed with the key of
another department?
Slide 36
Slide 36 text
No content
Slide 37
Slide 37 text
Container image built and signed
by the trusted application
pipeline?
Slide 38
Slide 38 text
No content
Slide 39
Slide 39 text
Fundamental Shift
on our Security
Slide 40
Slide 40 text
40
Slide 41
Slide 41 text
41
Slide 42
Slide 42 text
Act 3
The Architecture of
the Factory Floor
Slide 43
Slide 43 text
43
Slide 44
Slide 44 text
44
Slide 45
Slide 45 text
45
Slide 46
Slide 46 text
46
Slide 47
Slide 47 text
47
$ podman build -t quay.io/developer/some-image .
$ podman push quay.io/developer/some-image
$ oc new-app quay.io/developer/some-image
Slide 48
Slide 48 text
Conclusion
Slide 49
Slide 49 text
Trust.
Slide 50
Slide 50 text
Security
≠
“Department of No”
Slide 51
Slide 51 text
Trusted Software Supply Chain
Slide 52
Slide 52 text
52
Slide 53
Slide 53 text
Secure way == Easiest way
Slide 54
Slide 54 text
Sovereignty
Slide 55
Slide 55 text
No content
Slide 56
Slide 56 text
linkedin.com/company/red-hat
youtube.com/user/RedHatVideos
facebook.com/redhatinc
twitter.com/RedHat
Thank you