Modern DevOps has a paradox at its core: we build our most secure enterprise systems on top of thousands of open-source pieces we don't own, didn't write, and rarely audit. Incidents like the XZ Utils backdoor and Log4Shell made one thing terrifyingly clear,the open-source software (OSS) supply chain is the primary target for modern attackers.
But if open source is where the vulnerabilities are, why is open-source tooling our best defense?
In this talk, we will explore why proprietary, black-box security tools are failing to protect open-source ecosystems. We will introduce the Open Source Security Foundation (OpenSSF), a cross-industry initiative dedicated to fixing OSS security from the inside out.
We’ll look past the theoretical governance and dive into how OpenSSF creates open, standardized, community-driven tools that integrate directly into your DevOps pipelines. We will walk through three core pillars of the OpenSSF toolset:
OpenSSF Scorecards: Bringing radical transparency to OSS by automatically measuring the security posture of your upstream dependencies.
Sigstore: Cryptographic signing made so easy that we can finally eliminate static PGP keys and establish decentralized trust.
SLSA (Supply chain Levels for Software Artifacts): An open framework for building tamper-resistant pipelines so you can prove exactly where your code came from.
Come learn why the future of security must be open-source, and how you can use OpenSSF tools to start verifying—not just trusting—your software stack.
