🛡️ Enterprise DevSecOps & Software Supply Chain Security on GCP | The Google Cloud Podcast

Welcome to The Google Cloud Podcast! In today's 18th episode, host Bitu breaks down Enterprise DevSecOps and Software Supply Chain Security on Google Cloud Platform (GCP). Chapter Timestamps: 00:00 - Introduction & The New Software Supply Chain Threat Landscape 03:15 - The SLSA Framework: Levels 1 through 4 Demystified 07:30 - Cloud Build & Private Worker Pools: Zero-Trust Build Environments 11:45 - Artifact Registry: Tag Immutability, Vulnerability Scanning & SBOMs 16:20 - Binary Authorization: Deep Dive into Cryptographic Admission Control 20:45 - Automated Delivery & Governance with Cloud Deploy & Workload Identity 24:30 - Cloud Architect & DevOps Certification Scenario Walkthroughs Key Topics Covered: • The paradigm shift from pure CI/CD speed to verifiable software integrity and cryptographic provenance • The SLSA (Supply-chain Levels for Software Artifacts) framework: Achieving SLSA Level 3/4 compliance on GCP • Cloud Build Private Worker Pools: Single-tenant execution, zero public egress, and VPC Service Controls (VPC-SC) perimeters • Artifact Registry: Immutable tag policies, automated Container Analysis, continuous daily CVE re-scanning, and SPDX-compliant SBOM generation • Binary Authorization: GKE and Cloud Run deploy-time cryptographic admission control intercepting unvetted containers before execution • Multi-Attestor chains: QA verification, vulnerability scanning gates, manual SecOps approvals, and SLSA provenance signatures backed by Cloud KMS asymmetric keys • Declarative progressive delivery with Cloud Deploy and eliminating long-lived service account keys with Workload Identity Federation Subscribe to The Google Cloud Podcast on Spotify, Apple Podcasts, and YouTube Podcasts for daily architectural deep dives and certification mastery!