►
From YouTube: Getting Started with Supply Chain Security is Easier Than You... Michael Lieberman & Timothy Miller
Description
Don’t miss out! Join us at our next event: KubeCon + CloudNativeCon Europe 2022 in Valencia, Spain from May 17-20. Learn more at https://kubecon.io The conference features presentations from developers and end users of Kubernetes, Prometheus, Envoy, and all of the other CNCF-hosted projects.
Getting Started with Supply Chain Security is Easier Than You Think: Perspectives From a Highly Regulated Industry - Michael Lieberman & Timothy Miller, CitiBank
With the growing frequency of supply chain attacks and complexity of technology environments securing the software supply chain has never been more important, especially in highly regulated environments like banking. The road to a secure supply is long and challenging but getting started is easy. There are a series of practices that you can implement today to get you started on your supply chain security journey that will help you: better understand the technologies currently in your environments, establish provenance of source code, and help you audit and respond quickly in the event of supply chain vulnerabilities.
A
A
Mike
and
I
were
not
next
to
each
other
in
those
photos,
that's
just
like
really
weird
all
right.
So
what
we're
going
to
talk
about
is
why
we
care
about
supply
chain
security,
we're
not
selling
anything
we're
a
bank
or
an
end
user.
So
why
are
we
here?
What
you
need
to
do
to
get
started,
and
most
of
our
talk
is
going
to
be
about
a
demo
walking
you
through
this
we'll
wrap
up,
take
questions
and
go
home
all
right.
So
what
so?
A
Why
do
we
care
supply
chain
attacks
affect
everyone.
This
really
is
a
chain.
Every
time
you
all
are
compromised.
It
hurts
us
vice
versa.
We
recognize
that
problem
and
it's
real.
It's
a
real
thing,
the
from
a
regulatory
perspective
as
well.
Banks
have
to
deal
with
it
with
something
called
a
lot
of
a
lot
of
banks.
Call
this
controls,
basically
there's
just
a
bunch
of
rules
on
not
doing
unacceptable.
Things
like
having
developers
just
run
stuff
right
into
production.
A
So
we
kind
of
get
two
birds,
one
stone
with
being
more
secure
and
having
to
do
less
paperwork
which
I'm
a
very
big
fan
of,
and
then
and
lastly,
we're
not
special.
We
don't
have
different
concerns
than
anybody
else
developing
software.
This
is
a
general
generic
problem
for
everybody.
We
just
have
some
of
our
concerns.
Dialed
up
to
11.
A
That's
probably
not
step
one,
so
really
leaning
into
that
and
using
it
to
apply
that
to
your
environment
is
a
really
practically
helpful
thing,
a
lot
of
just
starting
generating
that
data,
not
even
doing
it
just
having.
It
is
a
very
good
first
step
separately
deciding
who
it
is
that
you
trust,
like
a
lot
of
this
stuff,
really
ends
up
just
being
not
which
libraries,
you
trust,
but
the
organizations
and
people
that
are
producing
it.
Do
you
trust
them,
or
do
you
not
trust
them?
A
Starting
to
put
that
thought
exercise
down.
First
is
really
practically
necessary.
These
signatures
don't
help
you,
if
you
don't
know
where
they're
coming
from.
If
you
don't
know
what
what
what
it's
telling
you,
it's
all
you
so
really
put
that
thought
in
and
then
just
start
going
well,
so
we'll
we'll
we'll
show
you
what
that
looks
like
here,
but
the
one
pitfall
that
I
think
we'll
talk
about
as
well.
Is
you
have
to
be
really
careful?
A
B
I'll
stay
here,
can
you
all
still
hear
me
all
right
all
right,
so
as
I
sort
of
shared
in
the
the
slack
channel,
if
you
want
to
follow
along
with
the
code,
the
code
is,
is
in
the
slack
channel,
but
just
to
kind
of
give
a
very,
very
high
level
overview,
and
a
lot
of
this
is
stuff.
That's
based
on
a
lot
of
the
work
in
the
reference
architecture
from
the
cncf.
B
If
you
want
to
learn
more
about
that,
there'll
be
some
discussion
about
it
tomorrow
at
cloud
native
security
con,
but
in
and
yeah,
and
so
just
to
give
you
a
high
level
overview,
though
using
a
lot
of
the
tools
that
were
kind
of
shown
off
earlier
today,
so
that
stuff
this
is
stuff
like
techton
tecton
chains,
you
know
using
s
bombs
and
then
all
that
sort
of
stuff
using
cosine
to
sign
images.
So
let
me
just
sort
of
walk
you
through
it.
B
C
B
C
B
Oh
okay,
so
it
built
the
canico
image.
It's
doing
all
this
sort
of
stuff,
it's
signing
the
s-bomb
and
attaching
that
s-bomb
to
the
actual
image
repository.
So
it's
gonna
live
along,
so
the
s-bomb
is
actually
living
alongside
the
actual
image.
And
it's
doing
some
you
know
verifying
the
digest,
and
so,
if
I
go
in
here
and
if
I
do
an
ls
like
a
crane
ls
of
my
image
right
and
just
for
for
shorthand,
I
just
took
my
image
here.
B
You
can
see
this
is
the
image
it's
the
tagged
with
latest
it
has
an
s-bom.
It
has
a
signature
for
that
s-bomb.
It
has
a
chains
at
a
station,
that's
you
know
attached
to
it
and
it
has
also
a
signature.
So
if
I
wanted
to
go
and
verify
any
of
these
things
right,
I
can
go
and
let's
say:
if
I
want
to
get
the
s-bomb,
I
can
use
the
s-bomb
signing
key
to
validate.
B
B
C
B
B
B
B
But
if
I
whoops,
if
I
go
right
now
and
change
the
canoco
task
and
uncomment
this
and
rerun
it
now,
what
I
have
is,
I
have
a
task
or
a
step
in
the
caniko
task
that
is
actually
validating,
that
the
parent
image
that
kaneko
is
running
assigned.
So
for
those
of
you
who
don't
know,
kaneko
is
sort
of
an
agentless
runner
right,
it's
not
running
in
docker
itself
and
so
on
and
so
forth.
So
it's
not
actually
seeing
the
emission
controller
from
the
perspective
of
you
know,
kubernetes.
B
So
what's
happening
right,
oh
and
here
here
we
see
like
well
okay,
so
it
was
using
an
image.
That's
a
builder
image
that
wasn't
signed,
and
so
now
we
validated
that
it's
signed
and
because
it
wasn't
signed,
we
didn't
verify
it.
It
somehow
came
in
hijacked
our
image
repository
now
we're
catching
it
right
before
we
couldn't
catch
it.
B
B
I'm
just
going
to
build
sorry
rebuild
the
good
image
and
sign
it
and
obvio
honestly,
you
know,
obviously
in
in
real
life
here
this
would
be
a
in
real
life.
This
would
obviously
you
would
go
through.
You
would
validate
the
the
parent
images
you
would
validate
the
builder
images.
You
do
all
that
sort
of
stuff.
C
B
B
You
know
using
stuff
like
hyverno
and
and
whatnot.
You
can
definitely
validate
signatures,
but
we
need
something
a
little
bit
more
powerful,
at
least
right
now
that
supports
the
ability
to
kind
of
validate,
also
the
attestations
themselves,
and
you
know,
validates
some
of
the
metadata
that
is
lives
alongside
the
image
so
using
opa
gatekeeper,
plus
a
an
api
wrapper
around
cosine,
we
can
do
stuff
like
validate
both
the
signature
of
the
image,
as
well
as
the
attestation.
B
So
as
priya
had
sort
of
mentioned,
chain's
attestation
format
is
already
you
know,
salsa
compliant.
It
can
prove
some
of
these
things.
So
so
then,
how
can
we
say?
Okay,
well,
production
now
requires
at
least
salsa
one
or
requires
salsa
two.
How
can
we
now
validate
this?
Well
before
doing
that?
Let
me
just
do
one
last
docker
pull
here,
just
to
kind
of
show
you
that
now
it's
been
fixed.
B
B
B
So
if
I
now
run
the
actual
cube
ctl,
sorry,
if
I
run
sorry
my
my
kaneko
chains,
demo
image
it
does
allow
it,
why
does
it
allow
it
well,
it
has
valid
salsa
attestations
right
through
chains,
and
it
also
has
a
valid
signature
and
those
two
things
combined.
We're
like
cool
this
is
we
think
that
you
know
this
is
good
enough
for
authorization
for
us,
and
so
all
of
these
things,
combined
right
are
are
just
one
of
many
steps
that
we
need
to
take
to
improve
supply
chain
security.
B
A
So
I
mean
we're
mostly
wrapped
up
here,
but
I
mean
just
just
to
wrap
up.
We
have
the
same
concerns
as
everybody
else.
This
is
a
general.
A
generic
problem
aligning
to
these
frameworks
can
be
a
helpful
way
to
lean
into
it.
Basically,
the
demo
that
mike
just
showed
as
a
result
of
going
through
and
trying
to
hit
salsa
one
and
then
leaning
up
and
leaning
up
and
and
just
using
that
to
prioritize
what
to
go,
get
done
and
then,
lastly,
just
every
time
anybody
makes
this
easier.
A
A
B
A
B
How
long
your
journey
to
getting
this
into
production
was
so
we
can't
get
into
too
many
details
about
production,
but
what
I
can
say
is,
for
example,
with
that
demo.
I
just
showed
some
of
those
features
did
not
exist
two
weeks
ago.
So
these
are
things
that
are
very
much
moving
very
very
and
I
think
it's
something
that
that
you
need
to
highlight,
which
is
just
the
the
old
model.
Hey
this
few
months
or
whatever
these
things
are
quick
and
the
attackers
are
becoming
more
sophisticated
just
as
fast,
so
we
gotta
we
gotta.