OpenSSF Courses

AI Risk Management Framework: Understanding NIST Standards and Implementation

Explore NIST's AI Risk Management Framework, understanding key regulatory approaches, potential impacts, and effectiveness in managing artificial intelligence risks and capabilities.

• YouTube
• 25 minutes
• Self-Paced
• Free Video

ClearlyDefined: A Crowdsourced Database of Licensing Metadata for Supply Chain Compliance

Discover how ClearlyDefined simplifies software licensing compliance through its crowdsourced database, API integration, and automated metadata management for efficient supply chain security.

• YouTube
• 27 minutes
• Self-Paced
• Free Video

Role-Based Access Is So Yesterday: Revolutionizing Authorization with Open FGA

Discover how Open FGA revolutionizes authorization systems by implementing relationship-based access control, offering enhanced security and flexibility beyond traditional RBAC limitations.

• YouTube
• 37 minutes
• Self-Paced
• Free Video

Assessing Open Source Software Projects in the Software Supply Chain Security

Discover techniques for evaluating open source software trustworthiness through process assessment, risk analysis, and supply chain practices, with insights from DoD's Unified Platform project.

• YouTube
• 31 minutes
• Self-Paced
• Free Video

Meeting the OpenSSF Security Baseline with Minder

Discover how Minder platform helps monitor and ensure OpenSSF Security Baseline compliance across repositories, with practical demonstrations of automated security posture management.

• YouTube
• 24 minutes
• Self-Paced
• Free Video

Open Source Software Transparency for Acquisition - Making Security Trade-off Decisions

Explore software security measurement strategies and trade-off decisions for organizations using open-source components, focusing on vulnerability assessment, process metrics, and cybersecurity analysis.

• YouTube
• 35 minutes
• Self-Paced
• Free Video

Living with and Leveraging GCC - Adding COBOL Support

Discover the journey of adding COBOL support to GCC, exploring collaboration strategies with established open-source projects and practical insights into contributing to major software initiatives.

• YouTube
• 43 minutes
• Self-Paced
• Free Video

Solving Air-Gap Problems the Cloud Native Way with Zarf

Discover how to streamline Kubernetes deployments in air-gapped environments using Zarf, enabling efficient packaging and deployment of workloads while maintaining supply chain visibility through automated SBOM creation.

• YouTube
• 25 minutes
• Self-Paced
• Free Video

Save the Elephants - Secure Your PostgreSQL Databases with TDE

Discover essential PostgreSQL database security through Transparent Data Encryption (TDE), protecting sensitive data from unauthorized access and malicious attacks while maintaining performance.

• YouTube
• 34 minutes
• Self-Paced
• Free Video

Supply-Chain Security: What Helping 200 Projects Improve Their Security Looks Like

Discover how Google's Open Source Security Team helped 200+ projects improve their supply-chain security, with insights on maintainer collaboration and practical security implementation strategies.

• YouTube
• 36 minutes
• Self-Paced
• Free Video

Trojan Model Hubs: Hacking the ML Supply Chain and Defending Against Model Serialization Attacks

Discover essential strategies for protecting ML systems from supply chain attacks, focusing on model scanning and cryptographic signing to defend against Model Serialization Attacks in public model hubs.

• YouTube
• 27 minutes
• Self-Paced
• Free Video

Navigating the Quantum Readiness Journey: Hands-on Guidance for Starting Your Migration

Explore quantum computing's impact on cybersecurity and learn practical steps for implementing quantum-resistant cryptography, focusing on crypto agility, standardization efforts, and migration strategies.

• YouTube
• 30 minutes
• Self-Paced
• Free Video

Validating Kubernetes Webhook Controllers - A Framework for Testing and Monitoring

Discover how to validate Kubernetes webhook controllers using Lula, enabling systematic testing and monitoring of critical security functions in evolving cluster environments.

• YouTube
• 23 minutes
• Self-Paced
• Free Video

Scorecard at Scale: Old and New Possibilities for Lifting Security on All Repositories

Discover strategies for implementing OpenSSF Scorecard at scale, exploring various tools and methods to assess, monitor, and enhance repository security across large organizations.

• YouTube
• 31 minutes
• Self-Paced
• Free Video

What Is Going On In Your Source Code? Understanding Software Component Analysis in Plain Language

Gain insights into software supply chain security concepts like SBOM, VEX, and SLSA, understanding their importance in protecting organizations from emerging security threats.

• YouTube
• 30 minutes
• Self-Paced
• Free Video