Open Source Security Foundation

Building Security Tooling: Trials and Triumphs
2024-11-28 14:00 - 15:00 UTC
Join Barun Acharya, who is many things ― a CNCF Ambassador, maintainer for KubeArmor, and works as a Software Engineer at Accuknox, as he gives us the inside story of what it is like to build and maintain security tooling. In his conversation, he will be explaining the common pitfalls one can expect when designing security tooling and the difficult decisions developer habits put them in.
If you’ve wondered how to strike a balance between building opinionated tooling that sets out to accomplish something versus being an open platform for developers, this live stream is certain to spark your interest. Join us to learn more about security, tooling, and the challenges that surround security awareness.

Livestream: All About SaaS Security
2025-02-06 14:00 - 15:00 (Asia/Kolkata)
Join us for a live stream with Aparna Hinge, Principal Product Manager at CheckRed, as she shares her extensive experience in securing SaaS applications. With over 15 years in building secure software, including 10 years in groundbreaking security research and product design, Aparna brings a wealth of knowledge to the table. As a Certified Information Systems Auditor (CISA), she possesses deep expertise in technical areas coupled with governance and policy requirements. This allows her to navigate the complexities of SaaS security with aplomb!
In this captivating session, Aparna will pull back the curtain on the often-hidden world of SaaS security, sharing firsthand accounts of the challenges she’s conquered and the intricate technical puzzles she’s solved while architecting robust security for the applications we rely on every day. Discover the nuances of safeguarding SaaS environments and glean invaluable wisdom from a true industry veteran.
CheckRed’s comprehensive security posture management (SSPM + CSPM) approach delivers a streamlined, centralized cloud security solution, providing comprehensive coverage across major cloud providers like AWS, Azure, GCP, and Linode, as well as over 50 widely used SaaS applications, including Salesforce, Microsoft 365, ServiceNow, and Okta.
Remember to join us live on Thu, Feb 6th, 2025!

Live stream: Sparks Fly, When Security Meets AI
2025-02-13 14:00 - 15:00 (Asia/Kolkata)
AI is now everywhere! But how prepared are we to protect our data, models, and defend other assets?
Join us for a special episode of our live streams where we explore the critical intersection of open source security and artificial intelligence. We’ll delve into the lack of security measures protecting AI systems and the urgent need to address the growing needs. This stream will help you gain an understanding of the vast attack surface in AI, from data poisoning and model theft to adversarial attacks and malicious code injection. It will also educate you about the potential risks of running untrusted AI/ML models, which would lead to attacks including cryptojacking, remote code execution, and data breaches.
This live stream features special guest Keerthana Rampa, who is an Associate Project Manager at AccuKnox. She is a leading expert in AI security and will share her deep knowledge and insights on the challenges and solutions in this rapidly evolving field.

Building A Diverse Understanding About Open Source Security with Arjun BM
2025-03-27 14:00 - 15:00 UTC
Dive Deep into the World of Cyber Security with Arjun BM, who is presently serving as the Head of Security at a global retail organization!
Join us for an exclusive live stream with the award-winning cyber security leader, Arjun BM! With over 20 years of experience having worked with cybersecurity within various domains, Arjun brings unparalleled insights into the ever-evolving landscape of digital threats.
In what is expected to be an engaging session, Arjun will delve into the following critical areas:
Security in Retail: Explore the unique challenges and strategies involved in safeguarding digital storefronts from various malicious actors.
Software Supply Chain Security: Uncover the vulnerabilities and best practices for securing the software supply chain in today’s interconnected world.
The India Cybersecurity Situation: Gain a deep understanding of the current cybersecurity landscape in India, including emerging threats and opportunities.
Don’t miss this opportunity to learn from a seasoned expert and get your burning cyber security questions answered live!
Arjun on LinkedIn

Threat Hunting With(in) Open Source
2025-05-27 14:00 - 15:00 UTC
Threat hunting in cybersecurity is a proactive and iterative process of searching through networks, endpoints, and datasets to detect malicious, suspicious, or risky activities that have evaded existing security defenses. Unlike traditional security measures that react to known threats or alerts, threat hunting assumes that adversaries may already be present in the environment and actively seeks them out using a combination of skilled human analysis and technology. Open source plays a significant role in the realm of threat hunting. Many powerful tools used for data collection, analysis, and visualization in threat hunting are open source, providing cost-effective and customizable options for security teams.
In this informative session, Rohit Sadgune takes us through his experience with threat hunting, with a healthy dose of OSS. Join us live on May 27th at 2 pm IST.

Introduction To The OpenSSF
2025-05-29 20:00 - 21:00 UTC
Often asked question ― What can be wrong with open source, that I need to secure it?
This session will provide answers. Along with a comprehensive overview of the vital work being done by the OpenSSF to address these critical challenges head-on. We will explore the landscape of key OpenSSF projects and initiatives, designed to identify, fix, and prevent security vulnerabilities in open source software. Learn how the OpenSSF community is working collaboratively to build a more secure open source supply chain for everyone. Whether you’re a developer, security professional, or simply sit downstream in open source ―― understanding the OpenSSF is crucial in navigating the future of software security.
Join us for a live stream introducing the Open Source Security Foundation (OpenSSF), a cross-industry collaboration dedicated to improving the security of the open source software ecosystem. As open source adoption accelerates globally, so too do the associated security risks, creating widening “chasms” that malicious actors can exploit. This increasing reliance on open source components means that vulnerabilities can have a significant “blast radius” across diverse applications and industries.
Tune in to learn how you can benefit from and contribute to a more secure open source world.

Zero Trust Network Access
2025-06-03 14:00 - 15:00 (Asia/Kolkata)
Presented by Tushar Anand, an experienced Security Engineer specializing in cloud security, application security, and compliance, with extensive skills in pentesting and risk management.
In today’s evolving threat landscape, traditional perimeter-based security is no longer sufficient. This talk, “Zero Trust Network Access,” will delve into the fundamental principles of Zero Trust and its critical role in modern network security. We will explore how assuming “never trust, always verify” can drastically enhance your organization’s security posture.
Tushar will guide you through the core concepts of Zero Trust Network Access (ZTNA) and discuss its relationship with broader network security practices. A key highlight of this session will be a demonstration of Qryptic, an open-source tool built by Tushar to practically illustrate ZTNA principles in action. This will provide valuable insights into how open source can empower security professionals to implement and understand complex security models. Join this session to deepen your understanding of ZTNA, explore practical open-source solutions, and learn how to commit to safeguarding your digital environments in an increasingly complex world.

Open Source LLM Security
2025-06-14 14:00 - 15:00 (Asia/Kolkata)
As Large Language Models (LLMs) become increasingly prevalent, the security of their open-source variants presents unique and critical challenges. While offering flexibility and accessibility, the open nature of these models can expose them to specific vulnerabilities and attack vectors. This talk will explore the emerging security landscape surrounding open-source LLMs, discussing risks such as data poisoning, model inference attacks, and supply chain compromises. Understanding these threats is vital for developers and users to leverage LLMs safely and effectively. We will delve into key security considerations and potential mitigation strategies for building and deploying secure open-source LLM applications.

OpenSSF Community Day India
2025-08-04
Hosting: Join us for the OpenSSF Community Day India this summer! Co-located with KubeCon + CloudNativeCon India, this event will bring the open source community together in Hyderabad, India.
About OpenSSF Community Days: OpenSSF Community Days bring together a vibrant community from across the Security and Open Source ecosystems to share ideas and progress on capabilities that make it easier to sustainably secure the development, maintenance, and consumption of the software on which we all depend. These events, held regionally and co-located with KubeCon or Open Source Summits, offer an opportunity to engage with the brightest minds in security for a day of collaboration and innovation in software security best practices. As a home for tools, standards, and education, OpenSSF provides attendees the chance to explore these resources, share their experiences, and contribute to a safer and more secure digital world.
