安全なソフトウェアサプライチェーンの実現 / secure-software-supply-chain-with-jfrog

2022/05/18 に実施した JFrog x SoftBank x PrismaCloud 共同 DevSecOps セミナーの JFrog 発表分です

Transcript

1. DevSecOps with JFrog Platform
   

   View Slide

2. 2
   §
   § Sr. DevOps Acceleration Engineer @JFrog
   § DevOps Liquid Software
   §
   @tsuyoshi_miyake
   miyaket@jfrog.com
   

   View Slide

3. 3
   TPS
   TPS
   - Wikipedia: Toyota Production System (https://en.wikipedia.org/wiki/Toyota_Production_System)
   DevOps
   

   View Slide

4. •
   •
   •
   4
   

   View Slide

5. 1
   SSC
   N
   5
   •
   •
   •
   

   View Slide

6. 1
   N
   6
   VCS (Git)
   CI/CD
   ???
   •
   •
   •
   

   View Slide

7. SSC
   OSS
   B
   C
   A
   OSS
   OSS
   SSC SSC
   7
   

   View Slide

8. 8
   •
   •
   •
   •
   

   View Slide

9. (CVE)
   by OSS
   (CVE)
   Executive Order on Improving the Nation s
   Cybersecurity
   CVE
   9
   

   View Slide

10. 24/7 Dedicated Support +
    DevOps Acceleration Service Arm
    BUILD TEST RELEASE DEPLOY
    CI/CD
    On Premises
    & Multicloud
    VCS
    ACCESS FEDERATION
    ACL SSO
    10
    JFrog Platform
    

    View Slide

11. Artifactory for
    11
    docker-prod-local
    docker-dev-local
    (default)
    docker-qa-local
    Docker Hub
    docker-remote
    docker
    

    View Slide

12. WATCHES
    Xray for SBOM (Software Bill of Materials)
    12
    POLICIES
    Security
    License
    Fail Build
    Web Hooks, Slack, Emails
    XUC
    (Xray Update
    Center)
    Bundle
    Build
    Build
    Repo
    Repo
    Frogbot
    IDE
    XRAY
    ARTIFACTORY
    SBOM
    (SPDX, CycloneDX)
    

    View Slide

13. 13
    PIPELINES
    > git commit
    Public Repos
    IDE
    Git Repo
    package
    .json
    ARTIFACTORY
    XRAY PLUGIN
    XRAY DISTRIBUTION
    DISTRIBUTION
    EDGE
    DISTRIBUTION
    EDGE
    Connect
    Pull Request
    with JFrog Platform
    

    View Slide

14. JFrog
    14
    

    View Slide

15. THANK YOU!
    

    View Slide