Attesting Practically: Exploring the Glue Behind Secure Runtime Environments - Jim Bugwadia, Nirmata
Channel: The Linux Foundation
Date: 2022-10-08

Attesting Practically: Exploring the Glue Behind Secure Runtime Environments - Jim Bugwadia, Nirmata

Attestations are rapidly gaining popularity in the software supply chain security community. But most people don’t yet have a practical understanding of how to use them to improve their existing software delivery pipelines, or how they can help you secure your runtime environments. In this talk, Jim will explore how to use Cosign, in-toto attestations, and VEX documents to act as the connective tissue between scanners and policy engines like Kyverno to create secure and auditable runtime environments. He will walk through an end-to-end flow that demonstrates how this system will allow you to react to software security threats and triage them effectively — allowing your teams to focus on critical issues and navigate through the noise and chaos.