OpenSSF Courses

OSCAL in Action - Real World Examples of Automating Policy and Compliance

Discover how CNCF projects like OSCAL Compass C2P v2 and OPA transform regulatory requirements into actionable policy-as-code, automating compliance evidence generation in cloud-native environments.

• YouTube
• 22 minutes
• Self-Paced
• Free Video

What Doesn't Kill You Makes You Stronger - The Vulnerabilities That Redefined Kubernetes Security

Explore five pivotal Kubernetes CVEs that transformed container security, uncovering threat patterns, mitigation strategies, and open-source tools that shaped today's resilient ecosystem.

• YouTube
• 27 minutes
• Self-Paced
• Free Video

SAFE-MCP - A Security Framework for AI and Model Context Protocol

Discover SAFE-MCP, a security framework mapping 65 attack techniques across 14 tactics to defend AI systems using Model Context Protocol from threats like Tool Poisoning and Command Injection.

• YouTube
• 22 minutes
• Self-Paced
• Free Video

Spice Check - Building an End-to-End SLSA Implementation

Discover how to implement end-to-end SLSA 1.2 protection using the AMPEL policy engine to secure software supply chains from source to release with verifiable evidence.

• YouTube
• 23 minutes
• Self-Paced
• Free Video

Securing Cloud-Native Workloads from the Metal Up

Discover hardware-backed security for Kubernetes workloads using TPMs, SPIRE, and SPIFFE to establish trusted identities from bare-metal servers to cloud-native applications.

• YouTube
• 28 minutes
• Self-Paced
• Free Video

We're All Consumers - OpenSSF Baseline for Open Source Security and Compliance

Explore how OpenSSF Baseline simplifies security compliance for open source projects, creating nutrition labels that benefit both maintainers and consumers.

• YouTube
• 29 minutes
• Self-Paced
• Free Video

You Can Sign It, But Can You Trust It? - Securing the Compilation Process

Explore securing software compilation processes using SGX enclaves and in-toto attestation to address supply chain vulnerabilities beyond traditional signing methods.

• YouTube
• 18 minutes
• Self-Paced
• Free Video

Applying DevSecOps Lessons to MLSecOps

Discover how to integrate security practices into ML development lifecycles by applying proven DevSecOps principles to address AI/ML-specific risks and build trustworthy models.

• YouTube
• 15 minutes
• Self-Paced
• Free Video

Moving Academia Toward Practice Through Accreditation

Discover how CNCF and OpenSSF's academic accreditation program bridges the gap between university education and industry needs in cloud technologies and supply chain security.

• YouTube
• 16 minutes
• Self-Paced
• Free Video

Achieving Positive Outcomes Across Ecosystems - Security Audits in Action

Discover how OSTIF conducts successful security audits for CNCF projects, applying expert third-party review best practices to strengthen open source security posture over 4+ years.

• YouTube
• 17 minutes
• Self-Paced
• Free Video

Baking a Security Community From Scratch

Discover how to build a thriving security community from the ground up using OSTIF's proven methods and adaptable strategies for engaging open source ecosystem members.

• YouTube
• 14 minutes
• Self-Paced
• Free Video

Where Should Source Attestations Live? Exploring Storage Strategies

Explore storage strategies for SLSA source attestations, comparing repo, API, and alternative options with security and discoverability tradeoffs.

• YouTube
• 11 minutes
• Self-Paced
• Free Video

AIxCC Results and New Open Source AI Projects To Help Secure Open Source Software

Discover how AI systems automatically find and fix cybersecurity vulnerabilities in open source software through DARPA's AIxCC competition and OpenSSF's role in open sourcing the results.

• YouTube
• 11 minutes
• Self-Paced
• Free Video

Federate, Scale, and Secure - Practical SPIFFE/SPIRE for Containers, VMs, and Real-World Infrastructure

Discover how to implement SPIFFE/SPIRE for workload identity across containers, VMs, and hybrid environments with practical patterns for scaling, HA, and federation.

• YouTube
• 19 minutes
• Self-Paced
• Free Video

The Migration to Post-Quantum Cryptography - Open-Source Innovations and Interoperability

Discover practical strategies for migrating to post-quantum cryptography using open-source tools like EJBCA, Bouncy Castle, and OpenSSL for quantum-safe infrastructure.

• YouTube
• 29 minutes
• Self-Paced
• Free Video