in-toto Courses and Certifications

Toto-Ally TUF: Simple Tools for a Secure Software Supply Chain

Learn to secure software supply chains using in-toto and TUF frameworks. Explore their integration, real-world applications, and new open-source tools for enhanced protection against cyber threats.

• YouTube
• 35 minutes
• On-Demand
• Free Video

Software Supply Chain Security Case Study at Anaconda

Explore real-world experiences in securing a large-scale open-source packaging pipeline, addressing challenges, implementing solutions, and achieving positive outcomes using respected security designs.

• YouTube
• 43 minutes
• On-Demand
• Free Video

Securing Your Infrastructure as Code Pipeline

Explore techniques for securing Infrastructure as Code pipelines, including static analysis, RBAC, and open-source tools like Open Policy Agent and Sigstore, to enhance productivity and compliance.

• YouTube
• 33 minutes
• On-Demand
• Free Video

The Road to Zero CVEs: People and Technology

Explore open source software vulnerabilities, supply chain security legislation, and emerging tools like Sigstore to fortify digital ecosystems and manage CVEs effectively.

• YouTube
• 36 minutes
• On-Demand
• Free Video

CNCF [Cloud Native Computing Foundation]

Enforcing Supply Chain Security and Simplifying Compliance Audit for ArgoCD Deployments

Explore techniques for securing supply chains and simplifying compliance audits in ArgoCD deployments using open-source tools like Guac, Sigstore, and in-toto.

• YouTube
• 20 minutes
• On-Demand
• Free Video

CNCF [Cloud Native Computing Foundation]

Protect the Pipe - A Policy-based Approach for Securing CI/CD Pipelines

Explore a cloud-native security framework for CI/CD pipelines using in-toto, Kyverno, and sigstore. Learn to implement policy-based controls and address unique security challenges in modern application delivery.

• YouTube
• 26 minutes
• On-Demand
• Free Video

CNCF [Cloud Native Computing Foundation]

Securing Your Container Native Supply Chain with SLSA, GitHub and Tekton

Practical guide to securing container native supply chains using SLSA principles, in-toto attestations, and step-by-step demos for achieving SLSA Level 2 in Tekton and Github Actions.

• YouTube
• 32 minutes
• On-Demand
• Free Video

CNCF [Cloud Native Computing Foundation]

The Chain of Trust - Towards SLSA L3 with Tekton Trusted Artifacts

Explore Tekton's approach to securing software supply chains through trusted artifacts, provenance, and Sigstore integration, addressing challenges in preserving the chain of trust for build systems.

• YouTube
• 40 minutes
• On-Demand
• Free Video

CNCF [Cloud Native Computing Foundation]

Cloud Native Supply Chain Security: Beyond SBOMs - Perspectives and Practices

Insights on cloud native supply chain security beyond SBOMs. Experts discuss straightforward approaches, simple security practices, and future perspectives using open-source tools and frameworks.

• YouTube
• 35 minutes
• On-Demand
• Free Video

A Step Closer to Secure Development: Using in-Toto and OPA Gatekeeper to Verify Artifact Integrity

Explore securing software supply chains using in-toto, Witness, Archivista, and OPA Gatekeeper. Learn to verify artifact integrity from development to Kubernetes deployment.

• YouTube
• 45 minutes
• On-Demand
• Free Video

CNCF [Cloud Native Computing Foundation]

Enforceable Software Supply Chain Policies and Attestations Using in-Toto

Explore software supply chain security using in-toto, focusing on policies and attestations to defend against attacks like SUNBURST. Learn to implement SLSA specifications and comply with regulations.

• YouTube
• 35 minutes
• On-Demand
• Free Video

CNCF [Cloud Native Computing Foundation]

Securing the Software Supply Chain with the In-toto and SPIRE Projects

Explore securing software supply chains using in-toto and SPIRE projects. Learn about cryptographic attestation, automated certificate issuance, and building trust in software releases.

• YouTube
• 20 minutes
• On-Demand
• Conference Talk

CNCF [Cloud Native Computing Foundation]

Kubernetes Supply Chain Security - Building a Secure Software Factory

Explore Kubernetes supply chain security, software factory approaches, and defense strategies against attacks. Learn about signing, verification, and lessons from SUNBURST to enhance cloud-native security.

• YouTube
• 36 minutes
• On-Demand
• Free Video

CNCF [Cloud Native Computing Foundation]

State of the Art Supply Chain Security - In-toto, TUF, and SigStore

Explore cutting-edge supply chain security with in-toto, TUF, and SigStore. Learn how these tools create a transparent, hack-proof system to protect software from developer to end-user.

• YouTube
• 32 minutes
• On-Demand
• Conference Talk

CNCF [Cloud Native Computing Foundation]

Cloud Native Supply Chain Security with Tekton and Sigstore

Hands-on overview of creating a secure zero-trust supply chain on Kubernetes using Tekton, Tekton Chains, and sigstore. Learn to protect pipelines, generate provenance, and integrate with In-Toto and SPIRE.

• YouTube
• 22 minutes
• On-Demand
• Conference Talk