By submitting this form, you agree to our 

A Standardized Approach to SBOM - Dan McKinney - ASW 173

In this segment, Mike and Dan McKinney from Cloudsmith will be discussing SBOM and what that looks like for your applications. Other topics include: cloud-native tooling for your software supply chain, the history of provenance, GPG Keys & signing commits, package consumption, understanding threat modeling, and knowing the roles and responsibilities when it comes to security of your assets. This segment is sponsored by Cloudsmith.

Visit https://securityweekly.com/cloudsmith to learn more about them!

Visit https://www.securityweekly.com/asw for all the latest episodes!

Show Notes: https://securityweekly.com/asw173

Dan McKinney

Solutions Engineer

A Standardized Approach to SBOM

LF Live Webinar: Continuous...Everything? Integration, Packaging, Delivery, and Security All in One!

Application delivery pipelines share many traits with any assembly line.

Open source libraries, runtimes, databases, and base images are raw materials to be inspected to ensure they meet quality and security standards. Modern applications combine these raw materials with custom code to create dynamic and complex environments, opening up an extremely effective attack vector.

While not new, software supply chain attacks are on the rise with changes in how applications are built. With open source components making up more than 80% of modern codebases, having a reliable “source of truth” for the security, compliance, and provenance of software and its dependencies is critical.

In this webinar, Snyk, CircleCI and Cloudsmith will share practices and tools that are helping developers create applications with integrity, quality, and security.

Find and fix known vulnerabilities in app dependencies and container images

Build a source of truth for open source packages to avoid malicious packages

Combine continuous packaging and security into a CircleCI delivery pipeline Create provenance and security quality gates as part of deployment workflows

Join Ryan Pedersen (CircleCI), Tom Gibson (Cloudsmith), and Tomas Gonzalez (Snyk) to learn how to manage and mitigate this new risk profile and create a more holistic application security approach.

Tom Gibson

Principal Engineer

Continuous...Everything? Integration, Packaging, Delivery, and Security All in One!

"Build It Yourself, They Said. It Will Be Worth It, They Said" Dev Week Enterprise Keynote Session

“We’ll build it ourselves!” We’ve all heard it, seen it, and likely been directly impacted by the decision to build a custom, in-house solution rather than use an existing one. Whether it’s a CI/CD tool, artifact management solution, or even the entire DevOps tech stack, it’s a common misconception that building it internally is easier, cheaper, and faster. When, in fact, the complete opposite is true! Modern development processes demand high levels of availability and performance, so building a custom system that provides both of these isn’t a trivial undertaking. So why, then do enterprises continue to build in-house? And what exactly are the benefits of purchasing an existing solution? And how does this impact the quality of their overall organization? Join Cloudsmith’s Dan McKinney in this session as he answers all of these questions while helping attendees understand the true difference between building and buying DevOps solutions, how to make the best decision for your organization, and the benefits of an existing solution made to solve the problems you face.

DevOps "Office Hours" (2020-12-09)

 for this special edition of Office Hours to discuss how Cloudsmith is helping our customers solve the toughest challenges in package management.

Using GitLab to publish packages to Cloudsmith: 

https://www.youtube.com/watch?v=9WpvfegCgBY

Create a Cloudsmith repository in under 60 seconds: 

https://www.youtube.com/watch?v=yzBEWrgbvQQ

https://help.cloudsmith.io/docs/welcome-to-cloudsmith-docs

Lee Skillen

Chief Technology Officer

Lee Skillen from Cloudsmith on streamlined software packaging, building startups, and on-premise

Lee Skillen, Founder and CTO at Cloudsmith, joins SemaphoreCI to discuss how Cloudsmith solves the complex issue of streamlined software packaging.

We also discuss the ups and downs of being an entrepreneur and starting one's own business.

This episode is also available as a podcast at 

https://semaphoreci.com/blog/lee-skillen-from-cloudsmith-on-streamlined-software-packaging

Cloudsmith Blog

A Standardized Approach to SBOM

Continuous...Everything? Integration, Packaging, Delivery, and Security All in One!

"Build It Yourself, They Said. It Will Be Worth It, They Said" Dev Week Enterprise Keynote Session

DevOps "Office Hours" (2020-12-09)

Lee Skillen, Cloudsmith CTO, on streamlined software packaging, building startups, and on-premise