Trust Nothing, Scan Everything: A Registry-First Security Strategy

Supply Chain security is most effective before deployment, not after. In this session we will demonstrate how Harbor an open source container-registry can act as the security enforcement point of a container supply chain, preventing vulnerable artifacts from progressing further downstream.

No Slides, with interactive live demo driven by the audience, we will cover Harbor's native Trivy integration, including scan-on-push, vulnerability reporting, deployment security policies. We then explore Harbor's Scanner API and show how Kubescape and trivy integrates through a scanner adapter, enabling multiple scanners to assess the same image and surface differing results.

Finally, we examine SBOM generation and storage as OCI artifacts, and how they support faster rescans and stronger software supply chain security.

1. Attendees will understand why the container registry is the most effective enforcement point in a software supply chain.

2. Learn how SBOMs stored as OCI artifacts provide the foundation for software supply chain transparency, attestation, and compliance.

3. Understand the value of combining results from different vulnerability scanners and data sources to improve security visibility.

4. Understand how trivy and kubescape scans the artifact and how policies enforce it.