安全なソフトウェアサプライチェーンの実現 / secure-software-supply-chain-with-jfrog

2022/05/18 に実施した JFrog x SoftBank x PrismaCloud 共同 DevSecOps セミナーの JFrog 発表分です

Transcript

1. DevSecOps with JFrog Platform
2. 2 § § Sr. DevOps Acceleration Engineer @JFrog § DevOps Liquid Software § @tsuyoshi_miyake miyaket@jfrog.com
3. 3 TPS TPS - Wikipedia: Toyota Production System (https://en.wikipedia.org/wiki/Toyota_Production_System) DevOps
4. • • • 4
5. 1 SSC N 5 • • •
6. 1 N 6 VCS (Git) CI/CD ??? • • •
7. SSC OSS B C A OSS OSS SSC SSC 7
8. 8 • • • •
9. (CVE) by OSS (CVE) Executive Order on Improving the Nation s Cybersecurity CVE 9
10. 24/7 Dedicated Support + DevOps Acceleration Service Arm BUILD TEST RELEASE DEPLOY CI/CD On Premises & Multicloud VCS ACCESS FEDERATION ACL SSO 10 JFrog Platform
11. Artifactory for 11 docker-prod-local docker-dev-local (default) docker-qa-local Docker Hub docker-remote docker
12. WATCHES Xray for SBOM (Software Bill of Materials) 12 POLICIES Security License Fail Build Web Hooks, Slack, Emails XUC (Xray Update Center) Bundle Build Build Repo Repo Frogbot IDE XRAY ARTIFACTORY SBOM (SPDX, CycloneDX)
13. 13 PIPELINES > git commit Public Repos IDE Git Repo package .json ARTIFACTORY XRAY PLUGIN XRAY DISTRIBUTION DISTRIBUTION EDGE DISTRIBUTION EDGE Connect Pull Request with JFrog Platform
14. JFrog 14
15. THANK YOU!