Course Objective & Scope
Modern software relies heavily on open-source packages, container base images and third-party CI/CD plugins; a single compromised dependency or build step can impact the entire enterprise. This course covers dependency confusion, typosquatting, malicious package releases, CI/CD pipeline abuse, SBOM generation (CycloneDX/SPDX), SLSA levels and cryptographic signing/provenance verification.
Participants configure automated SCA and SBOM generation in a sample build pipeline, sign and verify container images with Cosign, and create an internal software supply chain security checklist.
Who Should Attend?
- DevSecOps, DevOps and platform engineers
- Application security (AppSec) specialists and software architects
- Technical leads responsible for third-party software and open-source governance
- Prerequisite: familiarity with Git, package managers, containers and CI/CD pipelines
Key Takeaways
- Configure artifact repository policies that prevent dependency confusion, typosquatting and compromised packages
- Generate automated SBOMs and VEX documents in CycloneDX or SPDX format during builds
- Harden build environments such as GitHub Actions or GitLab CI in line with SLSA levels
- Sign container images and build artifacts with Sigstore/Cosign and enforce admission verification
- Build an enterprise governance checklist for onboarding open-source and third-party components
Curriculum
Software Supply Chain Threats and Real-World Incidents
- Attack points across the supply chain from source code to production
- Dependency confusion, typosquatting, protestware and build server compromises
Dependency Management, SCA and Secure Artifact Repositories
- Lockfile discipline, transitive dependency analysis and vulnerability reachability
- Private artifact proxies, package quarantine and license/vulnerability policies
SBOM Generation and Vulnerability Management with VEX
- Automated SBOM generation using CycloneDX and SPDX standards
- Rapid zero-day impact analysis across SBOM inventories and using VEX statements
CI/CD Pipeline Hardening and the SLSA Framework
- Pinning third-party pipeline actions, ephemeral OIDC credentials and least privilege
- SLSA (Supply-chain Levels for Software Artifacts) levels and isolated build environments
Cryptographic Signing, Provenance and Admission Verification
- Signing images and packages with Sigstore, Cosign and in-toto attestations
- Blocking unsigned images with Kubernetes admission controllers (Kyverno/OPA Gatekeeper)
Other Courses in This Category
-
MITRE ATT&CK-based adversary emulation, detection engineering and collaborative Purple Team exercises for offensive and defensive security teams closing visibility and detection gaps together.
- Live Course
- 5 modules
-
The NIST SP 800-61 lifecycle, incident triage, DFIR evidence collection, containment and root-cause analysis for security and IT teams managing cyber incidents under pressure.
- Live Course
- 5 modules
-
Log architecture, normalization, correlation rules, MITRE ATT&CK-based detection, alert triage and threat hunting for SOC analysts and security engineers reducing alert fatigue and catching real threats.
- Live Course
- 5 modules
-
SOAR playbooks, LLM and security agents for automated enrichment, alert triage, case summarization and human-in-the-loop response for SOC and security engineers scaling operations.
- Live Course
- 5 modules
-
Evasion, data poisoning, backdoors, model extraction and membership inference attacks and defenses under MITRE ATLAS for data science and security teams testing ML model robustness.
- Live Course
- 5 modules
-
OWASP Top 10 for LLM & Agentic Applications, direct/indirect prompt injection, RAG data leakage, MCP/tool-calling authorization and guardrail architectures for engineers building secure AI systems.
- Live Course
- 5 modules
Get in touch
