Content:

The workshop follows an incremental approach, inspired by the Agile Manifesto: Working Protection over Comprehensive Documentation, Incremental Hardening over Big-Bang Security, Developer Experience over Security Theater, Automated Verification over Manual Audits.

Participants progress through four levels, each building on the previous one. After each level, they have a functional setup with immediate value. The workshop addresses real attack vectors of the software supply chain: compromised dependencies, manipulated build pipelines, insecure package repositories.

Day 1: See, Understand, Control

– Level 0 to Level 1: Visibility ("I see what happens"):
... - Threat landscape: SLSA vectors and real-world attacks
... - Toolbox overview: Harbor, Kyverno, Cosign, Slim, Copacetic
... - Harbor basics: Pull/push, project structure, vulnerability reports
... - Consuming 3rd party images: Harbor proxy cache for DockerHub/GHCR
... - Image insights with Slim: xray and appbom on 3rd party images
... - Outcome: Own and 3rd party images flow through central registry, vulnerabilities are visible

– Level 1 to Level 2: Control ("I determine what is allowed"):
... - 3rd party risks: Typosquatting, malicious images, abandoned packages
... - Kyverno registry allowlist: Only Harbor proxy allowed, direct pull blocked
... - Verifying 3rd party signatures: cosign verify on official images
... - Generating SBOMs: Syft locally and in CI
... - Consuming upstream SBOMs: Find and read upstream SBOMs
... - SBOM policy: Kyverno blocks images without SBOM
... - Outcome: Direct pulls blocked, only signed/known upstreams allowed, SBOM requirement enforced

Day 2: Prove, Patch, Respond

– Level 2 to Level 3: Trust ("I can prove it"):
... - Signing and attestations: Cosign, keyless, SLSA provenance
... - Signing images: Cosign keyless with GitHub/GitLab OIDC
... - Verifying signatures: cosign verify, Rekor transparency log
... - Kyverno signature policy: Only signed images deploy
... - SLSA provenance: Generate and verify attestations
... - Outcome: Every image is signed, build provenance is attested

– Level 3 to Level 4: Resilience ("I can respond"):
... - Cyber Resilience Act: Requirements, timeline, impact
... - Patching strategies: Rebuild vs. patch-in-place
... - Copacetic: Patch vulnerable base image and re-sign
... - Outlook: SBoB and runtime with Falco
... - Full pipeline: Build, scan, patch, sign, SBOM, deploy
... - Checklist and next steps
... - Outcome: Independent CVE response, complete pipeline operational

You will not only get to know these concepts, but also implement them in practice.

Disclaimer: The actual course content may vary from the above, depending on the trainer, implementation, duration and constellation of participants.

Whether we call it training, course, workshop or seminar, we want to pick up participants at their point and equip them with the necessary practical knowledge so that they can apply the technology directly after the training and deepen it independently.