Security Day 2022 on Google Open Source Live

Time

Title

Opening for Security Day 2022 on Google Open Source Live

Alexandra Bush, Nicky Ringland

2 Minutes

Alexandra Bush

Head of Open Source Marketing

Google Cloud

Nicky Ringland

Product Manager

Google

Watch on-demand

Tooling to Help Secure Open Source Supply Chain

Jeff Mendoza, Laurent Simon

Open source demand continues to explode, representing a 73% YoY growth in developer downloads of open source components. Yet, even though projects have their code open-source, the security practices used to run, test, release, and maintain these are less known. Scorecards is a tool that inspects and evaluates the open source projects’ adherence to security best practices, and it can help evaluate the software you depend on. Allstar is a tool to keep your own GitHub projects’ practices secure as well. In this talk, learn about these two tools, developed by the OpenSSF.

15 Minutes

Jeff Mendoza

Software Engineer

Google

Laurent Simon

Security Engineer, Google Open Source Security Team (GOSST)

Google

Watch on-demand

After Advisory: Dependencies Post Disclosure

Nicky Ringland

Zero-days vulnerabilities in dependencies can send open source maintainers into a flurry of activity, and enterprise into panic, but what happens after the fact? We’ll take an ecosystem view of some recent high-profile advisories and assess how individual contributions as well as language features impact vulnerability mitigations.

21 Minutes

Nicky Ringland

Product Manager

Google

Watch on-demand

Improving your Software Supply Chain Security Moves with SLSA on Github Actions

Ian Lewis

Software Supply Chains have become an increasingly popular target for attackers in recent years. The Supply Chain Levels for Software Artifacts (SLSA) framework aims to help ensure your software builds are secure from source to production. In this session we will discuss how to use SLSA with Github Actions to sign builds with sigstore and verify it in your production environment.

20 Minutes

Ian Lewis

Developer Advocate

Google

Watch on-demand

Digital Signatures 101 and Sigstore

Asra Ali

Code signing is the foundation of authenticating software artifacts. In this talk, we'll explore what a digital signature is (and what it isn't!), problems around key management, and how projects like Sigstore can help.

24 Minutes

Asra Ali

Software Engineer

Google

Watch on-demand

After Party

Alexandra Bush, Asra Ali, Jeff Mendoza, Laurent Simon

After livestreaming the sessions, we will host an After Party where you can participate in an exciting quiz, and hear from our speakers and emcees!

38 Minutes

Alexandra Bush

Head of Open Source Marketing

Google Cloud

Asra Ali

Software Engineer

Google

Jeff Mendoza

Software Engineer

Google

Laurent Simon

Security Engineer, Google Open Source Security Team (GOSST)

Google

Forbidden

User account conflict

Forbidden

We'll be right back

Error authenticating user

You're currently offline

Your browser
is not supported

Share

Sign in or create account

Sign in with email

Sign in with Google

Sign in with email

Too many failed attempts

Create Account

Reset Password

Reset Password

Forbidden

User account conflict

Forbidden

We'll be right back

Cookies are disabled

Error authenticating user

You're currently offline

Your browser is not supported

Your browser
is not supported