Symantecs
Some checks failed
Gitea Actions Demo Training / Explore-Gitea-Actions (push) Failing after 0s
Some checks failed
Gitea Actions Demo Training / Explore-Gitea-Actions (push) Failing after 0s
This commit is contained in:
@@ -2,7 +2,7 @@
|
||||
|
||||
By far not complete, but check this out:
|
||||
|
||||
## Generating SBOM's
|
||||
## Generating SBOMs
|
||||
|
||||
<https://github.com/kubernetes-sigs/bom>
|
||||
|
||||
@@ -14,7 +14,7 @@ By far not complete, but check this out:
|
||||
|
||||
---
|
||||
|
||||
## Storing SBOM's
|
||||
## Storing SBOMs
|
||||
|
||||
<https://github.com/dlorenc/sbom-oci>
|
||||
|
||||
@@ -22,9 +22,9 @@ By far not complete, but check this out:
|
||||
|
||||
<https://dependencytrack.org>
|
||||
|
||||
---
|
||||
---
|
||||
|
||||
## Analysis
|
||||
## Analyzing SBOMs
|
||||
|
||||
<https://dependencytrack.org>
|
||||
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
## Introductions
|
||||
## Introduction
|
||||
|
||||
- Hello! I am:
|
||||
|
||||
@@ -6,10 +6,10 @@
|
||||
|
||||
- 🏢 Employed by i-share (www.i-share.nl)
|
||||
|
||||
- 👷🏼♂️ Devops/Gitops/Cloud/Container/Cluster/Linux engineer (Pick one)
|
||||
- 👷🏼♂️ Devops/GitOps/Cloud/Container/Cluster/Linux engineer (Pick one)
|
||||
|
||||
- 🎯 Passion: Secure K8S clusters (air-gapped) running secure containers
|
||||
|
||||
--
|
||||
|
||||
I've only got 5 minutes so let's move on
|
||||
I've only got 5 minutes so let's move on.
|
||||
|
||||
@@ -1,5 +1,5 @@
|
||||
class: pic
|
||||
|
||||
## Remember the word (and scan this link)
|
||||
## Remember that word (and scan this link)
|
||||
|
||||
.center[]
|
||||
@@ -4,11 +4,6 @@ class: pic
|
||||
|
||||
.center[]
|
||||
|
||||
??
|
||||
|
||||
Do you want this in production?
|
||||
A container full of junk you don't need
|
||||
|
||||
---
|
||||
|
||||
## And do you remember:
|
||||
@@ -20,12 +15,12 @@ A container full of junk you don't need
|
||||
---
|
||||
class: pic
|
||||
|
||||
## Like foodlabels SBOM tell you whay's inside
|
||||
## Like food labels SBOMs tell you what's inside
|
||||
|
||||
.center[]
|
||||
|
||||
???
|
||||
The foodlabel helps to determine the content of the package, even before you purchase the product.
|
||||
The food label helps to determine the content of the package, even before you purchase the product.
|
||||
|
||||
---
|
||||
|
||||
@@ -62,6 +57,6 @@ class: pic
|
||||
---
|
||||
class: pic
|
||||
|
||||
## And analyze them
|
||||
## And analyze them before you install something
|
||||
|
||||
.center[]
|
||||
|
||||
@@ -45,7 +45,7 @@ And if they do: How often are you surprised?
|
||||
|
||||
--
|
||||
|
||||
SBOM's are similar.
|
||||
SBOMs are similar.
|
||||
|
||||
???
|
||||
The foodlabel helps to determine the content of the package
|
||||
@@ -120,7 +120,7 @@ Licenses violations can cause issues as well
|
||||
|
||||
---
|
||||
|
||||
## Using SBOM's to obtain foreknowledge of CVE's
|
||||
## Using SBOMs to obtain foreknowledge of CVE's
|
||||
|
||||
Knowing upfront which CVE's could be deployed is a check that can be done easily if the SBOM file is available.
|
||||
|
||||
@@ -175,13 +175,13 @@ Example taken from: https://aquasecurity.github.io/trivy/v0.33/docs/attestation/
|
||||
|
||||
## Deployment prevention
|
||||
|
||||
Inspecting SBOM's is best done before deploying containers and friends. Prevention is always best.
|
||||
Inspecting SBOMs is best done before deploying containers and friends. Prevention is always best.
|
||||
|
||||
The OCI standard allows storing SBOM information in container registries which could be nice for future use.
|
||||
|
||||
The docker buildkit has builtin functionallity, eg: `docker buildx build --sbom=true -t <myorg>/<myimage> --push .` will automaticcaly create a SBOM and push it to the registry.
|
||||
|
||||
SBOM's can be generated by other commands as well and stored in other places.
|
||||
SBOMs can be generated by other commands as well and stored in other places.
|
||||
|
||||
Consider analyzing the information of the SBOM in a deployment pipeline and take action if necessary.
|
||||
|
||||
|
||||
@@ -4,10 +4,10 @@ class: pic
|
||||
|
||||
.center[]
|
||||
|
||||
Whenever I talk about SBOM's René (a collegue) can't get this tune out of his head.
|
||||
Whenever I talk about SBOMs René (a colleague) can't get this song out of his head.
|
||||
|
||||
I hope you have the same experience and can't stop thinking about SBOM's...
|
||||
I hope you have the same experience and can't stop thinking about SBOMs...
|
||||
|
||||
???
|
||||
|
||||
Sex Bomb is a song from 1999 by Tom Jones and dj Mousse
|
||||
Sex Bomb is a song from 1999 by Tom Jones and dj Mousse
|
||||
|
||||
Reference in New Issue
Block a user