Marina Moore

[CNCF @CloudNativeFdn]

Check out the Security Hub, open Nov 7-9 in Chicago at #KubeCon + #CloudNativeCon North America, a space to collaborate around the latest security practices.

Submit a talk: https://t.co/Z3LJVAfSJA.
Learn more: https://t.co/sa40BfqQ94.
Register: https://t.co/qStpS3rzt8.

[Michael Lieberman @mlieberman85]

For folks looking for some more hands-on cloud native security at @KubeCon_ , check out the Security Hub. Come for interesting discussions, project collaborations, and drive by cloud native security fixes!

https://t.co/Vp0ceZnZ8P

[Clint Gibler @clintgibler]

🛡️ Gittuf

A security layer for Git using ideas from The Update Framework

* Handles key management for repo devs
* Lets you set permissions for branches, tags, files
* Protects against Git metadata attacks

Backwards compatible with GitHub

By @openssf

https://t.co/pYVSC4VpDf

[Aditya Sirish @adityasaky]

There's now a formal proposal for in-toto's graduation at the @CloudNativeFdn, opened by steering committee member @torresariass!

https://t.co/mJvfMYLSi8

[Aditya Sirish @adityasaky]

Many people know of in-toto through #SLSA but don’t fully understand how they intersect. @inyourbits and I authored a brief blog post to explain how you can use in-toto for SLSA's build track and the upcoming source track! https://t.co/8aHyiJ50zD

[CNCF TAG Security - R. Raccoon @cncfsecurityTAG]

The schedule for todays unconference is posted! https://t.co/I0bNal9QYh

[CNCF TAG Security - R. Raccoon @cncfsecurityTAG]

Looking for the security village? Here’s a map of where to find us!

[CNCF TAG Security - R. Raccoon @cncfsecurityTAG]

We have last few spots for the day-of volunteer for the #SecurityVillage #unconference experience.

Sign up for a slot of your convenience at https://t.co/x8ghsaSH4O

#KubeConEU
@CloudNativeFdn

[CNCF TAG Security - R. Raccoon @cncfsecurityTAG]

Are you disappointed there won’t be a 0-day event for Security? Don’t be! Instead, come check out the new Security Village located inside KubeCon EU throughout the conference.

For more information, head over to -
https://t.co/0Cs0qfzeSX

#KubeConEU
#SecurityVillage

[Lisa Tagliaferri @lisaironcutter]

#KubeCon ContribFest – in-toto and The Update Framework

Join to help us protect the Software Supply Chain with TUF, in-toto, & @projectsigstore

Oct. 27, 2:30-4pm

[Marina Moore @marinanmoore]

@jp4gs @tracymiranda @mjasay @TechRepublic TUF is already used to secure the root of trust for sigstore, and there are other in-progress ideas for extending that to use TUF to determine which sigstore signatures should be trusted

[Marina Moore @marinanmoore]

I wrote a blog post about some of the tools in the software supply chain security landscape: https://t.co/0sJrMzXm0a

[Marina Moore @marinanmoore]

@_llzes @CryptoVillage Thanks @_llzes for putting together a great challenge!

[Marcela Melara, PhD @mas0mel]

📣 Call for papers - SCORED ‘22 📣
Excited to announce this new workshop on all things SW supply chain security @acm_ccs ‘22!
Website: https://t.co/URt3oKX7aR.
Short papers and demos welcome!
@torresariass @lsim99 and I are looking forward to your submissions!

[Marina Moore @marinanmoore]

I'll be at @cncfsecurityTAG #CNSecurityCon and @KubeCon_ next week! Check out our TUF Maintainer Panel on Monday https://t.co/5mgAn5gCSP

[CNCF @CloudNativeFdn]

We're excited to have the supply chain security project in-toto in the #CNCF Incubator! 🙌

Read more about what the project has accomplished since joining the Sandbox 👉 https://t.co/HzfkLfyW9g

[Marina Moore @marinanmoore]

@mlbiam A system like TUF can also give you revocation so that once you discover that your ci/cd system is compromised, you can communicate to users that they shouldn't use the compromised build

[Marina Moore @marinanmoore]

@mlbiam Just a single signature from the ci/cd system doesn't protect against a compromised account. But this can be combined with attestations from the developer (possibly even with an offline key), or other stages in the development for greater assurance

[Dan Lorenc @lorenc_dan]

The v1.4.0 release of @projectsigstore cosign now fully supports the community TUF root, thanks to @AsraEntr0py, @trishankkarthik, @torresariass, and @marinanmoore!

This allows us to securely manage/rotate all the signing keys, including the roots.

https://t.co/Y94PlgwpD8

[Marina Moore @marinanmoore]

@hi_joshuagl @lorenc_dan @Sh1bumi @torresariass @priyawadhwa16 @projectsigstore @OCI_ORG Yes! I think @AsraEntr0py has at least a PoC of this for sigstore