Practice lab: JFrog Compliance (JFTC-514): Automate DevGovOps Checks and Ensure Rigorous Security
It is a hands-on lab designed to automate DevGovOps and secure your software supply chain. You will learn to use JFrog Curation to filter open-source risks and Advanced Security to detect secrets and malicious code. This lab equips you to enforce rigorous security standards and ensure regulatory readiness across the entire SDLC.
This comprehensive lab series provides practical, hands-on experience in navigating the complexities of regulatory requirements and fortifying your software supply chain. Through a combination of automated policy enforcement and deep visibility, you will gain the skills necessary to establish a culture of compliance excellence. Attendees will explore how the JFrog Platform—specifically Curation, Advanced Security, and Release Lifecycle Management—enables organizations to automate governance and ensure rigorous security standards are met across the entire SDLC.
Labs in this series:
- OSS Filtering & SBOM Ingestion Lab: Master the first line of defense in your supply chain. This lab teaches you how to use JFrog Curation to intercept non-compliant or risky open-source packages before they enter your ecosystem. You will also gain experience in SBOM (Software Bill of Materials) ingestion, ensuring you have a complete, transparent inventory of every component in your software.
- Secrets & Malicious Indicators Lab: Go beyond basic vulnerability scanning. This lab focuses on JFrog Advanced Security to identify exposed secrets, passwords, and API keys hidden within your code. You will also learn to detect malicious indicators and suspicious packages, preventing "left-of-center" attacks and ensuring the integrity of your internal artifacts.
- Release Lifecycle Management (RLM) & Evidence Lab: Close the loop on compliance by mastering the release process. In this lab, you will use JFrog RLM to manage the progression of software through various stages. You’ll learn how to collect and store immutable evidence at every gate, providing a verifiable audit trail that proves your security policies were followed before any code reaches production.
Prerequisites:
- Familiarity with DevSecOps principles and regulatory compliance concepts (e.g., NIST, SOC2).
- Basic understanding of artifact management and the software development lifecycle (SDLC).
- Access to a computer with internet connectivity for hands-on exercises.