OpenSSF Courses

What is the OpenSSF? - An Introduction to the Open Source Security Foundation

Explore the OpenSSF's mission, structure, and initiatives to enhance open source software security with insights from Executive Director Brian Behlendorf.

• YouTube
• 10 minutes
• On-Demand
• Free Video

Finding LibRaska: The Open Source Library that Props up our Infrastructure

Explore challenges in identifying and supporting critical, yet obscure open source packages that underpin infrastructure. Learn strategies to enhance security in open source supply chains.

• YouTube
• 18 minutes
• On-Demand
• Free Video

What is OpenSSF? - Securing Open Source Software Supply Chains

Explore OpenSSF's mission to secure open source supply chains through automated tools, best practices, education, and collaboration.

• YouTube
• 17 minutes
• On-Demand
• Free Video

Improving Global Software Supply Chain Security with Alpha-Omega

Explore the Alpha-Omega Project's framework for enhancing software supply chain security, focusing on critical and long-tail open source projects. Gain insights into this new OpenSSF initiative.

• YouTube
• 19 minutes
• On-Demand
• Free Video

Connecting the Dots: SBOM and VEX in Software Security

Discover how SBOM and VEX documents work together to enhance software supply chain security, reduce vulnerabilities, and leverage trustification.io for accessing verified open-source components.

• YouTube
• 22 minutes
• On-Demand
• Free Video

Towards a Quantum Proof Software Supply Chain with Post Quantum Cryptographic Algorithms

Explore quantum vulnerabilities in software supply chains and learn how to implement Post-Quantum Cryptographic algorithms using Tekton as a practical example for creating quantum-resistant systems.

• YouTube
• 26 minutes
• On-Demand
• Free Video

Cooking up Secure OCI Artifacts with SLSA - Implementing Software Supply Chain Security

Discover practical steps for implementing SLSA standards in build pipelines, from generating SBOMs and provenance to using cosign for keyless attestations and ensuring secure OCI artifacts.

• YouTube
• 31 minutes
• On-Demand
• Free Video

Who Guards the Guards? - Securing Open Source Security Tools

Explore essential strategies for securing open-source software through multiple layers of defense, from transparency and automation to community-driven security initiatives and maintainer oversight.

• YouTube
• 18 minutes
• On-Demand
• Free Video

AI-Driven Policy Automation with Kyverno

Discover how to streamline Kubernetes security using AI-powered Kyverno policies, automating compliance checks and reducing manual intervention while maintaining zero downtime.

• YouTube
• 17 minutes
• On-Demand
• Free Video

CERT.in Guidelines on Software Bill of Materials (SBOM) - Understanding Regulatory Framework and Implementation

Explore CERT-IN guidelines on Software Bill of Materials (SBOM), covering regulatory requirements, implementation strategies, and global cybersecurity practices for enhanced digital security compliance.

• YouTube
• 14 minutes
• On-Demand
• Free Video

Automating Container Security: Docker Scout in CI/CD for Safer Software Supply Chains

Discover how to integrate Docker Scout into CI/CD pipelines using GitHub Actions for automated vulnerability scanning and enhanced container security in your development workflow.

• YouTube
• 18 minutes
• On-Demand
• Free Video

Securing CI/CD - Complexity and Inspiration from Runtime Security

Explore CI/CD security challenges and solutions through BOLT, an open-source tool leveraging eBPF and TLS interception to prevent data exfiltration in build environments and secure GitHub Actions.

• YouTube
• 12 minutes
• On-Demand
• Free Video

Quarantining and Locking Down Your Cloud Infrastructure with Kubernetes Sanitizers

Discover how to strengthen Kubernetes security using Popeye - an open-source cluster sanitizer that identifies configuration issues, resource misallocations, and RBAC vulnerabilities in cloud infrastructure.

• YouTube
• 15 minutes
• On-Demand
• Free Video

From CVE Chaos to Control: Building a Zero CVE Strategy

Master practical strategies to minimize and efficiently manage software vulnerabilities through dependency reduction, automated updates, and streamlined security processes for a more robust security posture.

• YouTube
• 18 minutes
• On-Demand
• Free Video

How We Adopted Secure Software Delivery Practices for Fission OSS Serverless Platform

Discover practical implementations of SLSA specifications in Fission's serverless framework, covering reproducible builds, signed artifacts, and secure dependency management for enhanced software supply chain security.

• YouTube
• 19 minutes
• On-Demand
• Free Video