in-toto Courses and Certifications

Toto-Ally TUF: Simple Tools for a Secure Software Supply Chain

Learn to secure software supply chains using in-toto and TUF frameworks. Explore their integration, real-world applications, and new open-source tools for enhanced protection against cyber threats.

• YouTube
• 35 minutes
• On-Demand
• Free Video

Software Supply Chain Security Case Study at Anaconda

Explore real-world experiences in securing a large-scale open-source packaging pipeline, addressing challenges, implementing solutions, and achieving positive outcomes using respected security designs.

• YouTube
• 43 minutes
• On-Demand
• Free Video

Securing Your Infrastructure as Code Pipeline

Explore techniques for securing Infrastructure as Code pipelines, including static analysis, RBAC, and open-source tools like Open Policy Agent and Sigstore, to enhance productivity and compliance.

• YouTube
• 33 minutes
• On-Demand
• Free Video

Docker

Container Security: Supply Chain, Authorization, and Runtime Protection

Explore container security: supply chain integrity, deployment authorization, and runtime protection. Experts discuss in-toto, TUF, Open Policy Agent, and container escape prevention.

• YouTube
• 1 hour 15 minutes
• On-Demand
• Free Video

CNCF [Cloud Native Computing Foundation]

In-Toto: Attestations and Software Supply Chain Security

Explore in-toto framework's advancements in software supply chain security, including attestation verification, type mapping, and integrations with CNCF projects and industry tools.

• YouTube
• 35 minutes
• On-Demand
• Free Video

CNCF [Cloud Native Computing Foundation]

State of the Art Supply Chain Security - In-toto, TUF, and SigStore

Explore cutting-edge supply chain security with in-toto, TUF, and SigStore. Learn how these tools create a transparent, hack-proof system to protect software from developer to end-user.

• YouTube
• 32 minutes
• On-Demand
• Conference Talk

CNCF [Cloud Native Computing Foundation]

Cloud Native Supply Chain Security with Tekton and Sigstore

Hands-on overview of creating a secure zero-trust supply chain on Kubernetes using Tekton, Tekton Chains, and sigstore. Learn to protect pipelines, generate provenance, and integrate with In-Toto and SPIRE.

• YouTube
• 22 minutes
• On-Demand
• Conference Talk

CNCF [Cloud Native Computing Foundation]

Notary: State of Development and Supply Chain Security

Explore supply chain security with Notary project overview, Notary v2 updates, and ecosystem context. Learn about TUF and in-toto projects and their role in achieving security outcomes.

• YouTube
• 37 minutes
• On-Demand
• Free Video

CNCF [Cloud Native Computing Foundation]

Achieving End-to-End Software Supply Chain Security with in-toto

Explore in-toto's advancements in software supply chain security, including artifact tracking, attestation types, and integrations with CNCF projects for cloud-native identity protection.

• YouTube
• 35 minutes
• On-Demand
• Free Video

CNCF [Cloud Native Computing Foundation]

Kubernetes Supply Chain Security - Building a Secure Software Factory

Explore Kubernetes supply chain security, software factory approaches, and defense strategies against attacks. Learn about signing, verification, and lessons from SUNBURST to enhance cloud-native security.

• YouTube
• 36 minutes
• On-Demand
• Free Video

CNCF [Cloud Native Computing Foundation]

Securing the Software Supply Chain with the In-toto and SPIRE Projects

Explore securing software supply chains using in-toto and SPIRE projects. Learn about cryptographic attestation, automated certificate issuance, and building trust in software releases.

• YouTube
• 20 minutes
• On-Demand
• Conference Talk

CNCF [Cloud Native Computing Foundation]

Protect the Pipe - A Policy-based Approach for Securing CI/CD Pipelines

Explore a cloud-native security framework for CI/CD pipelines using in-toto, Kyverno, and sigstore. Learn to implement policy-based controls and address unique security challenges in modern application delivery.

• YouTube
• 26 minutes
• On-Demand
• Free Video

CNCF [Cloud Native Computing Foundation]

Securing Your Container Native Supply Chain with SLSA, GitHub and Tekton

Practical guide to securing container native supply chains using SLSA principles, in-toto attestations, and step-by-step demos for achieving SLSA Level 2 in Tekton and Github Actions.

• YouTube
• 32 minutes
• On-Demand
• Free Video

CNCF [Cloud Native Computing Foundation]

Verifying Software Signatures with TUF and Sigstore

Explore secure software verification using TUF and Sigstore. Learn to design effective verification policies, understand signing limitations, and enhance security for open-source repositories and container registries.

• YouTube
• 36 minutes
• On-Demand
• Free Video

CNCF [Cloud Native Computing Foundation]

In-toto - Securing the Entire Software Supply Chain

Explore in-toto's protocol for verifiably defining and securing software supply chain steps, enhancing security guarantees for cloud-native and other ecosystems.

• YouTube
• 19 minutes
• On-Demand
• Conference Talk