"Building Trust: Strengthening Your Software Supply Chain Security"...

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

BUILDING TRUST:
STRENGTHENING YOUR SOFTWARE
SUPPLY CHAIN SECURITY
SERHII VASYLENKO

SERHII VASYLENKO
Senior Software Engineer at Grammarly
13 years in the industry
Specialization:
- CI/CD and Security Autom...

Recognition
Kudos and warm regards to:
Sacha Faust, Vladimir Suslenko, Sara Wachulec, and Yerassyl Altay
For their incredi...

AGENDA
1. Why it matters
2. Challenges and outcomes
3. Supply Chain Security
a. Addressing “Build”
b. Addressing “Deploy”
...

AGENDA
1. Why it matters
2. Challenges and outcomes
3. Supply Chain Security
a. Addressing “Build”
b. Addressing “Deploy”
...

Why Supply Chain Security Matters?
SolarWinds:
- compromised build system, malware injected to the product,
over $100M in ...

Why Supply Chain Security Matters?
Grammarly PoV:
- We are only as secure as the things we build on top of
- 96% of vulner...

AGENDA
1. Why it matters
2. Challenges and outcomes
3. Supply Chain Security
a. Addressing “Build”
b. Addressing “Deploy”
...

Challenges and Setting
- CI/CD configurations
are not standardized
- Development velocity is a
priority
- 600+ active repo...

Outcomes
- 59% drop in Critical vuln’s in runtime in the last 6 months
- 90% auto-remediation rate in source code without ...

Security Automation Principles
Reproducible
Security
Automated
Reasoning
Automated
Remediation
Developer
Experience

1. Why it matters
2. Challenges and outcomes
3. Supply Chain Security
a. Addressing “Build”
b. Addressing “Deploy”
c. Addr...

Automated Updates with Renovate
Workflow:
- Auto-PRs for updates
- Auto-merge security fixes
- Semantically grouped
update...

Renovate Architecture

Centralized Dependency Management
Centralized Repository:
- JFrog, Harbor, Sonatype Nexus, Cloudsmith, etc
Benefits:
- Sin...

Applying Controls

AGENDA
1. Why it matters
2. Challenges and outcomes
3. Supply Chain Security
a. Addressing “Build”
b. Addressing “Deploy”
...

Deployment Challenges
You want to scan the deployable artifact:
- How do you know what is deployed?
- How do you know when...

Piercing the Deployment
Scanner inside the deployment tool
- For ECS
- For K8s
GitLab feature “Compliance pipelines” to en...

Image Validation
For K8s, Wiz Admission Controller
Two conditions to accept the image for deployment:
1. Image must come f...

Deployment-Scanning Architecture

Our Learnings From Rolling This Out
Early Prevention: "Warn & Engage"
Flexibility First:
- Adjustable ignore lists
- Guide...

AGENDA
1. Why it matters
2. Challenges and outcomes
3. Supply Chain Security
a. Addressing “Build”
b. Addressing “Deploy”
...

Runtime Monitoring: Assessment
Context:
- Resource exposure
- Vulnerability type
Likelihood:
- Network access
- Attack vec...

Runtime Monitoring: Response
SLA-driven ticketing:
- Priority assignment
- Response time tracking
- Intervention policy fo...

AGENDA
1. Why it matters
2. Challenges and outcomes
3. Supply Chain Security
a. Addressing “Build”
b. Addressing “Deploy”
...

4 Pillars of Security Automation
Reproducible Security: "Security as Code"
Automated Reasoning: "Context-Aware Decisions"
...

linkedin.com/in/svasylenko | devDosvid.blog
BUILDING TRUST:
STRENGTHENING YOUR SOFTWARE
SUPPLY CHAIN SECURITY
SERHII VASYL...

Share Slideshare

LinkedIn
Facebook
Twitter

Embed

Size (px)

Show related Slideshows at end

WordPress Shortcode

Link

Share
Email

2024 Trend Updates: What Really Wor... by Search Engine Jou... 1049688 views
Storytelling For The Web: Integrate... by Chiara Aliotta 964375 views
Artificial Intelligence, Data and C... by OECD Directorate ... 895413 views
How to Leverage AI to Boost Employe... by SocialHRCamp 377996 views
2024 State of Marketing Report – by... by Marius Sescu 214368 views
Everything You Need To Know About C... by Expeed Software 232744 views

View on Slideshare

1 of 28 Ad

View on Slideshare

1 of 28 Ad