Speaker
Abstract
Open Source Security Foundation (OSSF) Scorecards provide a way for open source users to determine whether maintainers are being diligent about securing their link in the software security supply chain. Practices such as pinning dependencies, branch protection, required reviews, continuous integration tests etc. are measured to provide a score and accompanying badge.
This presentation will provide a walkthrough of the steps involved in securing a first repository, and then what it takes to repeat that process across and organization with multiple repos. It will also look at the ongoing maintenance involved once scorecards have been implemented, and how aspects of that maintenance can be better automated to minimize toil.
Topics
QCon New York 2023 is a three day conference for senior software engineers, architects and team leads. An international program committee of working engineers selects every session. Patterns and practices, not products and pitches.
Part of the track
Next Gen Fintech: Performance, Complexity & Privacy Hosted by Neha Sardana Vice President & Senior Developer @MorganStanleyFrom the same track
Wednesday 14 June
10:35 Dumbo / Navy Yard Session Maximizing Performance and Efficiency in Financial Trading Systems through Vertical Scalability and Effective Testing Peter Lawrey CEO @Chronicle_SW In the fast-paced world of financial trading, speed, and efficiency are essential. To achieve this, vertical scalability is crucial in order-processing systems. However, achieving vertical scalability can be a significant challenge for developers. That's why testing is critical. 11:50 Salon A-C Session Data Performance and Scale - Domain-Oriented Objects vs Tabular Data Structures Donald Raab, Rustam Mehmandarov Working with large data structures in memory poses certain restrictions on performance and scalability. 13:40 Dumbo / Navy Yard Session API Security Protecting APIs in Financial Services with Zero Trust Overlay Mesh Networks Clint Dovholuk Head of Developer Experience @OpenZiti / NetFoundry As a senior software developer in the financial services industry knows, protecting APIs from cyber threats and attacks is critical. 14:55 Carroll Gardens Unconference Unconference: Next Gen Fintech What is an unconference? An unconference is a participant-driven meeting. Attendees come together, bringing their challenges and relying on the experience and know-how of their peers for solutions. 16:10 Dumbo / Navy Yard Session Security Implementing OSSF Scorecards Across an Organization Chris Swan Engineer @atsigncompany Open Source Security Foundation (OSSF) Scorecards provide a way for open source users to determine whether maintainers are being diligent about securing their link in the software security supply chain. 17:25 Dumbo / Navy Yard Session Fintech Portfolio Analysis at Scale: Running Risk and Analytics on 15+ Million Portfolios Every Day William Chen Director and Technical Fellow @BlackRock In finance, many common calculations are more or less just linear algebra – but at a massive scale and done very fast.