TestifySec

Heading to #DAFITC this week? We are here and excited to chat with folks. Keep an eye out for Cole Kennedy and ask him how we have been creating guardrails for product governance. He will be onsite Tuesday and Wednesday. #DAFITC24 #DAFITC2024 #airforce

It’s 2024, don’t be the one caught managing your software supply chain with an Excel spreadsheet… 🙈💻 Spreadsheets are great for budgets, not for security! Pro tip: Secure your supply chain the right way with #intoto, #Witness, and #Archivista. Send us a message to learn more. #Friday #CyberSecurity #compliance #supplychain

Last month Bob Harwood highlighted the importance of #provenance in the software development lifecycle... Along with best practices and critical elements he mentioned a few ways to achieve software provenance, one of which is with of our #opensource tools Witness and Archivista to add attestations and policy management to your development pipeline. "Attestation software, like #Witness, can record and sign information about the build process, including timestamps, environment variables, and test results. These results can be saved in databases using tools like #Archivista. Admission controllers can enforce policies to permit or deny updates based on if the artifacts have enough evidence to justify their use." Check out the full article below. #compliance Statefarm Insurance Cloud Native Computing Foundation (CNCF) #intoto

#Kubecon is only a few months away and our own John Kjell will be speaking on Secure Release Processes with #intoto policy verification. John will be joined by fellow in-totonaut Aditya Sirish A Yelgundhalli from New York University Thursday November 14, 2024 4:30pm - 5:05pm MST Regency Ballroom BCD Talk Description: Ensuring software releases adhere to expected processes is crucial for both open-source projects and enterprise software. The in-toto project offers a solution by creating attestations for each step, providing verifiable evidence of #compliance. Over the past five months, community contributors have worked to enhance the definition and capabilities of in-toto layouts to enforce policies for these attestations. This presentation will showcase the results of this effort, demonstrating how to create flexible policies for any software development lifecycle (SDLC) process, from source code commit to production release. We will explore how to formulate policies that verify #attestations for code reviews, SBOM integrity, testing, #vulnerability scans, build provenance (such as SLSA), and more. Join us to learn how to ensure your software development process is compliant and secure. Make sure to save this talk in your favorites and let us know what specific problem you want them to talk about. Congratulations to all those who were selected to speak. We are excited to learn from you. #testifysec #CNCF Cloud Native Computing Foundation (CNCF)

We know it's Friday, and your weekend is calling, but before you sign off, join us TODAY at 11:00 AM Eastern for the #Witness and #Archivista Community Call! Whether you're already contributing or just curious, this is your chance to dive into these powerful #opensource projects that simplify evidence collection and help keep your software secure. Let’s collaborate and make these tools even better—details to join are below. Brought to you by The Linux Foundation, TestifySec, Cloud Native Computing Foundation (CNCF) and #intoto. More details and links are inside our github community: https://lnkd.in/gcCiAs9W

🚀 Ready to accelerate your software delivery while staying ahead of federal compliance requirements? We have partnered with Carahsoft to deliver workshop on Achieving Compliance with NIST 800-204D and transform your software supply chain security! In this hands-on training, we'll equip your cybersecurity and app sec teams with the tools and knowledge to: ☑ Master the essentials of NIST 800-204D and the SSDF framework. ☑ Implement a secure, SSDF-compliant pipeline in GitLab or GitHub. ☑ Automate compliance to reduce security risks and streamline collaboration between development and security teams. With modules covering everything from supply chain attack history to practical implementation of the #intoto framework, you'll leave with a rock-solid understanding of what it takes to secure mission-critical environments. 👉 Don't miss out! Submit your training request today and get a customized quote tailored to your needs. Let's secure the future of your software delivery together! Submit here: https://lnkd.in/drBS3Uta #CyberSecurity #SoftwareSupplyChain #DevSecOps #Compliance

We kicked off the day at DoD Platform One Industry Day with an insightful Q/A panel featuring the #platformone value stream leads and leadership team. It was a great opportunity to learn about their focus areas, challenges, and future development roadmap firsthand. As a #smallbusiness and #startup, engaging with our government partners is crucial to supporting the warfighter down range. We look forward to more collaboration opportunities like this across the Air Force and government agencies. Let's continue to innovate ways for small businesses to partner with the #government, following the lead of AFWERX. Excited to be invited and chosen to pitch our compliance and governance platform at TestifySec. If you're in Colorado Springs this week, reach out – we'd love to connect. Huge thanks to Catalyst Campus, Colorado Springs for hosting us this week. #testifysec #thisistheway

It’s easy to talk about security, to throw around buzzwords, and to stack up endless checklists. But how much of that actually translates into real, actionable security? 🤔 Too often, we see "gurus" who are great at the talk but not so great at implementation. They focus on complex workflows that sound impressive but don’t provide the real coverage needed to protect the supply chain. Here’s the truth: Security isn’t about saying the right things; it’s about doing the right things. At TestifySec, we don’t just talk about security—we build it into every step of our process. We focus on targeted coverage, actionable insights, and automated checks that accelerate compliant software deliveries. Because at the end of the day, it’s not what you say that matters—it’s what you do. Let’s raise the bar. Let’s move beyond the buzzwords and focus on delivering real value. Who’s with us? #opensource #testifysec #intoto #compliance

Who else will be at the DoD Platform One Industry Day in Colorado Springs next week? Our team is excited to attend and looks forward to connecting with everyone. Send us a message if you will be there next week. See you at Catalyst Campus!

Cole Kennedy will be at the Space and Missile Defense Symposium today in Huntsville. If you are around, send him or us a message to meet up and chat about what ever you are working on today. And as a bonus, Cole will tell you all about how we are simplifying compliance and reducing risk across the software development process by automating evidence collection and policy management. #Symposium #SoftwareDevelopment #SMD