OpenSSF Courses

Hitchhikers' Guide to the Vulniverse

Explore key elements of vulnerability disclosure and management, including CVE, CVSS, CWE, and VEX. Gain insights into communication between security teams and researchers.

• YouTube
• 23 minutes
• On-Demand
• Free Video

Run GenAI Projects at Scale Securely: From the Operating System to the MLOps Platform

Secure and scale GenAI projects across the entire stack, from OS to MLOps platform. Learn key considerations, best practices, and opportunities for highly regulated industries.

• YouTube
• 21 minutes
• On-Demand
• Free Video

Enforcing Organization Policies with Enterprise Contract

Learn to enforce organizational policies on container images using Enterprise Contract, leveraging Sigstore signatures and in-toto attestations within the Tekton ecosystem.

• YouTube
• 21 minutes
• On-Demand
• Free Video

Prioritisation of SCA Findings in Software Dependencies Using Static Reachability Analysis

Explore static and reachability analyses for effective prioritization of software dependency vulnerabilities, enhancing security and productivity in development workflows.

• YouTube
• 23 minutes
• On-Demand
• Free Video

Securing Content Distribution with RSTUF, an Incubating OpenSSF Project

Explore RSTUF, an OpenSSF project for securing content distribution. Learn about its implementation, adoption by PyPI and RubyGens, and use in private repositories and Archivista for in-toto attestation storage.

• YouTube
• 22 minutes
• On-Demand
• Free Video

Exploring Essential Security Checks for Open Source Go Projects

Discover essential security tools for Go projects: gosec, govulncheck, and sigstore/cosign. Learn to enhance code security, scan vulnerabilities, and secure the supply chain.

• YouTube
• 25 minutes
• On-Demand
• Free Video

ML Model Signing: Cryptographically Paving the Way to Provenance in Machine Learning Models

Explore cryptographic signing for ML models, enhancing trust and provenance in AI. Learn about open-source specifications for verifying model integrity and strengthening the AI supply chain.

• YouTube
• 21 minutes
• On-Demand
• Free Video

Web Developer Security: Best Practices and Beyond

Explore latest web security developments, technologies, and best practices for developers, including insights from recent workshops and W3C initiatives.

• YouTube
• 18 minutes
• On-Demand
• Free Video

The Current State of Open Source Security Compliance Tooling Is Well, Sad

Explore practical approaches to improve software supply chain security using OpenSSF projects, open source tools, and open data for automated compliance and robust processes.

• YouTube
• 18 minutes
• On-Demand
• Free Video

Will eBPF Save Us From the Next Global Outage?

Explore eBPF's potential to prevent global IT outages through kernel-level security enhancements, without compromising system stability or performance.

• YouTube
• 14 minutes
• On-Demand
• Free Video

Security Initiatives in Community Driven Projects: Looking Ahead with Python and Rust

Explore security initiatives in Python and Rust foundations, focusing on community engagement, consensus building, and future strategies for sustainable open-source security practices.

• YouTube
• 20 minutes
• On-Demand
• Free Video

Navigating the Quantum Readiness Journey: Open-Source Cryptography, PKI and Signing Tools

Explore quantum-resistant cryptography for IoT, containers, and software supply chains using open-source tools. Gain hands-on insights into FIPS-certified APIs, PKI software, and signing solutions for enhanced cybersecurity.

• YouTube
• 13 minutes
• On-Demand
• Free Video

German National Guideline on SOSS-Lifecycle: Community Outreach

Explore Germany's guideline for secure open source software development lifecycle and provide input on challenges, goals, and ideas for enhancing security without burdening the community.

• YouTube
• 13 minutes
• On-Demand
• Free Video

Managing Vulnerabilities in Open-Source Dependencies

Learn strategies to secure open-source dependencies, evaluate software composition analysis tools, and shift from reactive to proactive security postures in product development.

• YouTube
• 13 minutes
• On-Demand
• Free Video

Automated End-to-End VEX Streams You Can Trust

Explore automated VEX streams for trusted vulnerability communication. Learn to build end-to-end systems using OpenVEX, enhancing software security without human intervention.

• YouTube
• 19 minutes
• On-Demand
• Free Video