OpenSSF Courses

A Glimpse Into Open Source Software Vulnerability Disclosure Practices

2 ratings

Explore current challenges and solutions in open-source software vulnerability disclosure, examining security advisories, bug bounty reports, and maintainer perspectives for improved OSS security practices.

• YouTube
• 31 minutes
• Self-Paced
• Free Video

The State of Git Security With SLSA and Gittuf

1 rating

Explore Git security beyond forge platforms using gittuf for repository policies and SLSA for source provenance, including new read permissions and standardization efforts.

• YouTube
• 24 minutes
• Self-Paced
• Free Video

Multi-messenger Security - Adaptive Kubernetes SOC From Disparate eBPF Tools

Discover how to build an adaptive Kubernetes Security Operations Center using eBPF tools like Kubescape, Pixie, and Tetragon for enhanced threat detection and data sovereignty.

• YouTube
• 25 minutes
• Self-Paced
• Free Video

From Adoption to Innovation - LinkedIn's SPIRE Journey

Discover how LinkedIn scaled SPIRE for hundreds of thousands of workloads, addressing unique security requirements through custom extensions and hardware-based trust solutions.

• YouTube
• 26 minutes
• Self-Paced
• Free Video

It's Not a Best Practice If No One Can Follow It - Learning From Our Container Security Mistakes

Discover practical container security lessons from Twistlock and Alpine Linux founders, covering hardening strategies, common pitfalls, and actionable approaches for modern deployments.

• YouTube
• 28 minutes
• Self-Paced
• Free Video

Trust, Track, and Verify - Securing AI Pipelines End-to-End

Discover how to secure AI pipelines using BOMs, provenance tracking, and cryptographic attestations to mitigate supply chain risks in open-source AI systems.

• YouTube
• 23 minutes
• Self-Paced
• Free Video

OSPS Baseline - Improving Your Project Security the Easy Way

Discover how to enhance open source project security using OSPS Baseline with clear, actionable guidance tailored to your project's size and compliance needs.

• YouTube
• 25 minutes
• Self-Paced
• Free Video

Turn Down That Noise - Why the OpenSSF Security Baseline Is Good for Maintainers

Discover how OpenSSF's Security Baseline helps open source maintainers navigate global regulations like EU's CRA and US NIST SSDF while reducing compliance noise from downstream users.

• YouTube
• 29 minutes
• Self-Paced
• Free Video

Driving Policy to Secure the Open Source Ecosystem

Explore how policymakers respond to open source security threats like Log4shell and XZ Utils, plus learn to influence future OSS security legislation and policy development.

• YouTube
• 27 minutes
• Self-Paced
• Free Video

How Secure Is Academic Open Source? Insights From the UC OSPO Network

Discover security challenges in academic open source software through UC's network-wide assessment using OpenSSF Scorecards and analysis tools for safer research code.

• YouTube
• 25 minutes
• Self-Paced
• Free Video

Dirty Dancing - Untrustworthy SLSA Build Provenance

Uncover the reality behind SLSA Build Level 3 certification and learn to identify when provenance attestations can't be trusted despite appearing valid.

• YouTube
• 23 minutes
• Self-Paced
• Free Video

Threat Modeling for Kubernetes - Enhancing Security Posture in Complex and Regulated Environments

Discover practical threat modeling strategies for Kubernetes environments, focusing on risk identification across clusters, workloads, and third-party components in regulated sectors.

• YouTube
• 31 minutes
• Self-Paced
• Free Video

Who Let the Agents Out? Securing AI Workflows the Right Way

Discover how to secure AI agent workflows with trusted identities, zero-trust architecture, and SPIRE workload identity integration for production-ready agentic platforms.

• YouTube
• 25 minutes
• Self-Paced
• Free Video

Transparency Exchange API - Where To Find Product SBOM?

Discover how the OWASP Transparency Exchange API standardizes access to SBOMs, certifications, and security metadata across software and hardware supply chains.

• YouTube
• 23 minutes
• Self-Paced
• Free Video

The Whole Is Greater Than the Sum of Its Parts - A Case for Interoperable Supply Chain Tooling

Explore software supply chain security tooling interoperability challenges and solutions, covering frameworks like in-toto, SLSA, Sigstore, and GUAC for enhanced security.

• YouTube
• 23 minutes
• Self-Paced
• Free Video