Cloud Native Computing Foundation Cloud Native Security Conference North America 2021, 30 Oct 2021

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: Securing the Software Supply Chain with Open Source - Dan Lorenc, Google

Description

Don’t miss out! Join us at our next event: KubeCon + CloudNativeCon Europe 2022 in Valencia, Spain from May 17-20. Learn more at https://kubecon.io The conference features presentations from developers and end users of Kubernetes, Prometheus, Envoy, and all of the other CNCF-hosted projects.

Securing the Software Supply Chain with Open Source - Dan Lorenc, Google

The software industry is stepping up its response to securing the software supply chain but the challenges are still immense. A concerted effort is needed that spans companies, communities, and industries. Fortunately, many open source projects are emerging as part of the solution. Additionally, the Continuous Delivery Foundation hosts key CI/CD projects and has a mission to improve the world's capacity to deliver software with security and speed through communities of practice. This talk gives an overview of emerging open source projects & initiatives such as CDF and ways to get involved so we can all work together to accelerate securing the software supply chain.

A

Yeah thanks: uh my name is dan lawrence. um I'm talking about securing the supply chain with open source, how many people were at supply chain security con yesterday, quite a few people um cool, so I'm this is basically a little bit of a recap, a summary of that for today. So sorry for going over some old stuff again, let me go kind of quick and then re-show the premiere of operation, salsa, the video explaining uh how to secure supply chain with the salsa framework, um so I've been working in open source security for a while.

A

um This is a quick before and after picture. um This is about when pops wig was up to date. um This is what I looked like at the start of the pandemic and when I started worrying about open source and supply chain security- and this is a little bit more accurate today.

A

So this has been a long time and the more you look and the more you worry about supply chain security, the more stuff you find it's a pretty scary field today, so I'm going to start out just by talking about open source. We've got some numbers here, I'm not going to go too far to it. This is an open source conference. How many people here commit to open source projects?

A

Okay, awesome, pretty much everybody, uh then I'm gonna talk about some of the problems a little bit and then end with that exciting video. uh So this was a couple. Recent surveys from soda type venture beat a bunch of other ones. 90 to 98 of all modern organizations are using open source. I think the other two percent are lying or confused or didn't understand the question they filled out. It's it's impossible to build software today without using open source in some way.

A

The numbers are pretty shocking, too, though this is one or two things: everyone is using 135 software components on average, but depending on the framework depending on the ecosystem. It's not uncommon to see this go out to the thousands and many thousands um if you've heard the word s bomb or that phrase program a lot. It's about getting all this information tracked in one place and, as you can see, the combinatorics and numbers start to blow up. So this becomes really important.

A

Really fast open source is everywhere, and particularly cloud native right cloud native is built on open source, all the cloud native tools, the landscape, that everybody loves to see and watch and make fun of because it grows so much. That's all open source software and it's amazing, the innovation that everyone is doing publicly but open source has been under attack over the last several years right.

A

So it's awesome that we've done all this in public, and now we need to take time to protect that public good together, particularly these last couple years, right, open source, is often funded and worked on by maintainers that do this in their spare time.

A

The kubernetes release process itself is driven by a couple individuals that do this in their volunteer process.

A

Kubernetes is one of the most active projects in the world with hundreds of maintainers, but there's still only a few people cranking turning the crank on the release process and actually making sure the artifacts get out there securely when we see this all over if the foundations are not strong at the bottom of most open source projects because we're just not paying attention to them.

A

um At the same time, these funding issues the burnout issues, everybody getting tired of responding to things on github, uh it's becoming more important and more critical are starting to see open source supply chain attacks grow like crazy. A couple surveys had a 430 percent increase in 2020.. There was just another one with a 650 increase from sona type, and I think the eu predicted a 400 increase next year. So these are happening more and more often.

A

So time to turn it around time to get motivational, what can we do to help? There are a bunch of different projects. Kirsten just mentioned some great ones in this space like six store, tacton chains, the entotle project, the update framework, all these things in the linux foundation and different open source foundations, and here in the cncf as well a lot of us putting these pieces together.

A

A lot of it is just taking this seriously and working together as an industry. Thinking about open source security thinking about supply chain security is the most important first step, because that's what led us here is people not thinking about it and not worrying about it.

A

So I have a couple memes here kind of showing the issue. I have a few versions of this one so I'll show um yeah. Then this is the reality of things today right we're we've been very comfortable for years building and deploying our modern brand new cloud native kubernetes applications uh to these uh amazingly scalable infrastructures, but in a lot of cases, these things are getting built and deployed on jenkins servers sitting on mac minis under somebody's desk and that's the problem here.

A

Your build system should be at least as secure as the environment that it's deploying things into. If you with one takeaway, it's treat your build system the same way you do your production environments, here's another version of it, a little bit more tidally from this year and pulling back in the other supply chain.

A

Metaphor: um yeah, the world software supply chains and one person underpaid or not paid at all in a lot of these open source cases trying to fix this on their own, and this is the real issue we need to find those people we need to support them. We need to help them as an industry.

A

So, along that theme, is a new initiative called the salsa framework or slsa slsa.dev, and this is being developed by the open source security foundation. The open ssf, which is a sister foundation to the cncf I mean it, defines a bunch of levels here right. How can you get started? Taking these things seriously, how can you get started? Protecting your build system defines levels from one all the way up to four.

A

So if I worried you, if I scared you about open source security to start out here, the salsa project is here to help. So let me switch over to that and I will end with this awesome video, which you can find on youtube and on twitter.

A

I might have to plan this out here.

A

Should it be good.

A

B

You all know why you're here, software supply chains, all over the world are being hacked and we need to get to the bottom of it. Does everybody remember what salsa is.

A

Well, we don't have much salsa in iowa. I.

B

Expected more fair day.

A

It's just a dip for chips, right.

B

Come on picante, let's get serious.

B

Let me remind you: salsa is the supply chain levels for software artifacts, it's a framework that you can use to ensure the integrity of your software supply chain. It ranges from levels one through level, four and as you go higher in level, the more secure your software supply chain becomes today we're going to use salsa to figure out why software supply chains all over the world are being breached and we're going to use it to neutralize the threat agent queso. The screen.

B

This is a big problem, as I'm sure you've noticed supply chain attacks have been increasing in the past few months and we've seen it in the mainstream news. Trillions of dollars have been lost and that's why it is more important than ever to secure your software supply chain. Your supply chain consists of many steps from building your code testing it to deploying it to production, and you may be, depending on different environments and using different services as well.

B

That's why it's important to make sure that every step of the supply chain is secure at every step. You are vulnerable to a different type of attack, and that is why you need to take different measures to make sure that your entire chain is safe. Does anybody have any questions?

B

Good agent, queso, water.

B

We're under attack these supply chains aren't going to secure themselves. Let's go.

A

Yeah, so I want to thank eric spencer back here. He produced these videos, give him a round of applause.