Cloud Native Computing Foundation CloudNativeSecurityCon 2023 - Seattle, 2 Feb 2023

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: Let’s Talk Software Supply Chains with TAG Security - Michael Lieberman, Kusari

Description

Don't miss out! Join us at our upcoming event: KubeCon + CloudNativeCon Europe in Amsterdam, The Netherlands from 18 - 21 April, 2023. Learn more at https://kubecon.io The conference features presentations from developers and end users of Kubernetes, Prometheus, Envoy, and all of the other CNCF-hosted projects.

Let’s Talk Software Supply Chains with TAG Security - Michael Lieberman, Kusari

The supply chain security working group has been working to provide guidance and resources for projects looking to improve their supply chain security. In this talk, we will discuss the outputs of this working group, including the Software Supply Chain Security Whitepaper, catalog of supply chain compromises, and our reference architecture for a secure supply chain. We will also discuss our recent survey about supply chain security, and have interactive discussions about next steps for this working group. Bring your questions and ideas about supply chain security!

A

All right so uh I'm Mike Lieberman, and uh we're going to talk about uh tag Securities uh software supply chain uh working group here, all right, um a little bit about myself, um I'm Mike, Lieberman I am a co-founder of a supply chain. Security, startup, called uh kusari um I am also a salsa steering committee member for folks who are familiar with sort of the salsa supply chain. Security. Standard um I am a cncf tag.

A

Security lead and I helped co-lead the cncf, secure software Factory reference architecture, which we'll talk a little bit later here and so for about. You know the next half hour or so I'll rant to you about how great uh tag Securities software supply chain working group is- and um you know hopefully convince some of you who aren't already contributing to help contribute so first off for those who don't know and um what what is tag. Security well I mean you're at a cloud native security con.

A

Hopefully you know, but if you don't um it's what it says on the Tim, it's the security, technical Advisory Group for uh the cloud native Computing Foundation. It's made up of motivated uh volunteers interested in and contributing to Cloud native security. So, just to be clear: it's not purely Security Experts myself, I started joining tag security when I was at an end user company I was at a giant Bank, just sort of interested in security, and now hey I'm I'm up here. Talking about it.

A

So for folks who are, you know not sure, uh no feel free to join we're interested in everybody uh uh joining um we're. Also, tax security is also the largest cncf technical, Advisory Group, and um we also have the best mascot.

A

Okay, so what is the um secure? uh Sorry, the software supply chain, security uh working group in the in-tech security? Well, it's a subgroup um with tag security being so large. We have a lot of different work streams, one of them being software supply chain security. We also have a controls working group. We have a zero trust working group that is along with a few others, so because uh software supply chain security is so nascent.

A

It's such a new thing, we're not just you know, helping out with uh you know, fixing supply chain security, we're helping to find it in the larger space, and we have contributors who sort of you know across the Spectrum. We have. You know, folks from end user organizations, folks from giant Banks folks from insurance companies and all that as well. As you know, folks, like myself, who are now at a startup, um and we have folks from like larger institutions like IBM, Google and so on uh across multiple Industries.

A

So, let's talk a little bit, what we've done in uh the past and we'll kind of I'll be switching back and forth between uh the presentation here, just to kind of show off some of what we've done so uh going through right. We, we have an ongoing supply chain compromise list, so this is just sort of a list of known supply chain incidents and we have write-ups on the supply chain, incidents and and interesting facts about them.

A

We've uh have it. We wrote up a software supply chain security, best practices guide, uh which is you know once again focused on that cloud native uh security. You know aspect right like it's, not just purely open source. It's about. How can we secure uh the supply chains working inside of uh applications like kubernetes or application platforms like kubernetes we've also built out a secure software Factory reference architecture which I I helped co-lead, um which is based around you know, trying to figure out.

A

How do we, you know securely, build and- and you know, protect against attacks that we've seen with stuff. Like uh you know, the solar winds style attack uh We've also created a cncf project supply chain security survey, which is um focused around uh trying to see within the cncf.

A

What are some of the big challenges that some of the uh various cncf projects are running into from supply, chain security, and then we've also collaborated with a lot of other cncf groups, including stuff, like the tag security controls working group to try and take some of those best practices and turn them into uh controls, and then, in addition to that, we also could collaborate across the LF uh with other organizations like the CD foundation and openssf on projects like some of their supply chain, security, stuff like at the CD Foundation, as well as projects like salsa, which is a supply chain security standard.

A

So let's, uh actually before doing this, let me show off a little bit of uh one of the other things here. Give me one! Second, all right, you sorry so many tabs here we go so here is the catalog of supply chain compromises coming from our group and so there's a whole bunch of stuff.

A

Here it's an open sort of uh thing, so we we are accept PRS and- and we actually, if you have, for example here um if you look at the issues, there's lots of folks who have opened up issues here to sort of say: hey, here's another compromise we found and uh that ends up in this catalog and in addition to here, we actually have a bunch of you know if we click on one of these, let's just say the vs code, one there's a bunch of write-ups on sort of the impact and what type of compromise additional references and those sorts of things that we found that it's very useful for folks who are interested in understanding more about what types of supply chain attacks.

A

Are there and what's happened in the past and we're also looking to sort of collaborate with other groups like The, open ssf, to make this more than just Cloud native focused supply chain compromises, but just general open source supply chain compromises.

A

We are also very interested in um uh also pulling in additional data from other researchers as well on that and before I show off the software supply chain security best practices if folks are interested. The link is in that QR code there and I'll leave it up for for a minute, but just while we kind of go through that I'll talk a little bit about um uh software supply chain.

A

uh The the security best practices here, but I'll give that a minute um all right, and let me just move on to the next slide, just to kind of show this right here it so um so what is the supply chain? Software supply chain security, best practices guide? It is a um you know: it's a set of best practices for uh the supply chain, security, it spans the entire sdlc and I'll show that off in a second.

A

um It is both a set of specific best practices that often can be turned into stuff, like controls, as well as just sort of General guidance around how to approach certain things.

A

uh Interestingly enough, it's actually been cited in the nist's secure software development framework. So some of the stuff that uh you know the government has said: hey here's. What we think we should uh do is actually they cite um this guide uh as a reference and um just some examples here. Right like some of it is. This is stuff like uh you know, requiring sign, commits two-person code review, those sorts of things, but I will switch over to the guide here real quickly.

A

Oh sorry, that's the sorry. My tabs all got messed up here.

A

ah There we go so um so this is like the supply chain. uh This is just an example of what we've worked on here in um the the uh the software security working group. Sorry, software supply chain, security, working group, and so this is an example. uh This came out. I believe it was 2021 um and I contributed a little bit to it, which is um the the uh it is a set of best practices. It includes a bunch of information about like what is supply chain security.

A

um You know uh what you know. It's mostly focused at a broader level. um This was you know before a lot of the tools have come out uh today, but it talks a lot about, like you know, stuff like shared responsibility.

A

um It talks about stuff, like you know how to secure software I'm, sorry how to secure your source code and how your source code, you know a compromise to your source code could potentially lead to larger impacts down the way um it followed by then you know how to secure the build itself and what are the impacts of a of a um of an insecure build, and um you know things like you know, using Branch protection rules and and all these different things to sort of make sure that you're securing both your software or sorry securing your software dependencies.

A

Securing your source code, securing um all the things throughout the sdlc until production, I won't go too deep into it. You're more than welcome to sort of uh read this and then, if folks have questions, afterward I'm more than welcome to uh more than welcome to to ask them all right.

A

So the software supply chain security, best practices after that was released. There was a desire by the group to then say: okay, what can we do to start building an architecture around this? To start to say, hey what sort of things can we then do from those best practices and then turn it into something?

A

That's actually an architecture and that's where the secure software Factory came into play and that's something that I co-led with a few other folks like Andres Vega from control plane and uh the link to that is also up there in the QR code and I'll. Leave that up for for a minute or two.

A

And so, just as an ex you know uh to provide some, you know background the secure software Factory rate, like you had these best practices. What do we actually do about it, and so you know we can what's what's kind of that critical piece, and the critical piece here is: is that build um because when you think about a lot of things like dependencies and source code and and the artifacts that you eventually run into production? Well, what's the kind of? What's that key funnel and the key funnel here is the build pipeline itself?

A

It's where you're taking source code is where you're taking dependencies is where you're taking all this external stuff, that's often unprivileged you're, then compiling it building it running tests, Etc and then packaging it all up and you're trying to turn it into something. That's privileged to then run in um an environment like production right or being distributed to customers, and so the approach we took with this was you know we feel like there's three core tenants to sort of securing the build.

A

First. Is you want to secure the pipeline itself? You want to make sure that only approved things are allowed to run and in fact certain things must be run. So as an example, if you are, you need to generate an s-bomb, you need to run a security scan if you're a Dev. You should not be allowed to disable that right.

A

So that's one key piece and so that's kind of securing orchestration, but then what about the actual workloads that are running, especially in a cloud native context right, you know in a cloud native context, one of the problems is well. It doesn't matter what I'm running an admin to the kubernetes cluster can just swap out a container image in a pod right.

A

Well, that's where you know stuff like workload, identity comes into play and where you want to actually secure the workload from being tampered with, and so that's stuff, like spiffy Spire from implementation standpoint, and then you actually want to secure, obviously what the workload itself is actually doing. So if you have a build I, don't know you're running go, build or whatever you want to make sure that you know using stuff like ebpf or other sorts of introspection techniques. You want to make sure that the build itself is not doing something nefarious.

A

It's not trying to reach out to the internet and download something from malware.com or whatever right, um and so. Another thing also is that you know, as part of the collaboration right there's a demonstrative implementation of this secure software. Factory, that's maintained by the openssf called Fresca and I will show a little bit more of what the secure software Factory uh looks like here.

A

So I'll, just you know, see if I can find a good diagram here. Let's just kind of just sort of show off uh here we go. I know it's, maybe not the easiest thing to read here. So let me try and but here's an example of what that secure software Factory looks like here's some diagrams. It's about I, don't know yeah it's about like 20, Pages uh worth of write up diagrams and so on um and uh yeah.

A

There's a bunch of stuff in here about how you know, approaches to take to sort of you know, secure the build on how to sign things. You know using things like Sig store and so on, and if folks have questions about this, also at the end uh feel free to to bring it up all right.

A

So those are the two main pieces of uh big sort of um uh deliverables over the past few years from uh the supply chain, security working group, and so what are we currently uh doing right? So one of the big ones um is uh supply chain security tool mappings.

A

So um that's something that uh one of the one of our core contributors, Marina Moore, is, is working on and just kind of to show a little bit of that is um we have.

A

This is just a spreadsheet, but you know the idea here is we're looking to sort of look at those supply chain, security, best practices, stuff, that's referenced in the secure software Factory and be able to sort of map those controls and map those best practices and and various other requirements into what tools in generally in the space, do we see kind of hitting those things and we're? Definitely you know anybody who's, a contributor, we'd love to kind of see.

A

You know if you think your tool, kind of hits these things yeah like please, come and uh tell us about your tool. um You know, obviously, as long as it's open source and we'd love to have that included and we'd love to kind of you know know more more about this. You know know more about what what folks are working on.

A

So that's uh one key piece. Another key piece is which is just starting now in um uh John John from VMware uh is working on. This is the uh real world supply chain uh uh security policy, which is um the goal of this, is going to be trying to kind of build out like a couple like white papers and those sorts of things around hey.

A

How will people, actually you know, how do people actually approach supply chain security at an organization and what sorts of things are they worried about, and how do they take those best practices and understand those best practices and things like the secure software Factory and understand how do they prioritize different elements of it and what are the things that should be important to them and what are the things that they should be concerned about foreign.

A

Okay and then um what do we plan to do right? So there's a bunch of stuff that we want to do in the future, um but two of the big ones are. We want to build a supply chain security, Improvement program for the scenes for cncf projects themselves um and those uh that's where you know we actually want to go out and build out uh like almost like a journey for for cncf projects to kind of, say, Hey. You know similar to how you have incubation, you have um you you have.

A

uh You can keep dating projects, you have projects that have passed, Security review and so on. We want to have a set of requirements for cncf projects as well, because, as you can imagine, right like if a lot of folks are relying on kubernetes and if kubernetes supply chain is broken, then your supplyness change is broken. If you rely on kubernetes.

A

So that's kind of one of the things that we're looking to do, and we know that, like a lot of projects already like kubernetes, are you know implementing things like salsa they're, implementing a lot of the supply chain, security, best practices, but we want to extend that across um the cncf projects right because there are a lot of you know as you might be.

A

um If you take a look right like there's a lot of tools in the cncf that are security tools, and we want to make sure that those security tools themselves have a secure supply chain and then, in addition to that, we want to partner with more groups across the Linux foundation and across the broader community, on some of these sorts of initiatives.

A

Right and and many of the members who are you know, Volunteers in um uh in tax Securities supply chain security working group also contribute to open ssf contribute to the CD Foundation, um as well as many other sort of Open Source groups. uh Like you know, there's folks. We have folks who contribute to oasp who contribute to us and vice versa, and so we are very interested in kind of continuing to to collaborate. There.

A

And then how can you get involved right? um Well, uh we meet every Thursday at 11, A.M Eastern. uh You know you can find the invite on the normal cncf calendar. uh The meeting is open to everyone who follows the code of conduct and also consents to recording. um All of our meetings are recorded and they end up on YouTube uh afterwards.

A

So if also folks, who are interested, who just want to understand like hey what what sorts of things we're working on, you could go to the cncf, uh YouTube channel and just kind of look through, and you can see some of our recorded meetings and then, if you just kind of interested in other things, just sort of on the day-to-day, what sorts of things are going on in the cncf uh security?

A

uh Sorry in the cncf supply chain security working group, you should take a look at the tag, security issues and there's a bunch of different things in there um yeah and so that's kind of uh it for the main piece and then I'm just going to kind of just go through a few things here um and I know sorry to pick on Marina. That I had just actually talked about your your your mapping, spreadsheet, just as right before you walked in um so yeah.

A

There's the the there is a tools, mapping um spreadsheet that we, you know once again that uh working on and that, if folks are interested um you know, Marina's is is leading that up and then um you know for folks who are interested in controls right. There is the tag, uh there's there's the controls working group, which sort of built out a spreadsheet um for controls and then uh somewhere down here at the bottom I believe, and let me see if I can increase the size.

A

These are like you know, um supply chain, security, best practices, Rewritten as controls, and also there are some mappings to you know what what sort of nist requirement do they potentially map to? Not everyone does map directly to a nist requirement, but there's some stuff there and- um and there is potentially some work there just so you know to sort of maybe map integrate that with oscal.

A

If folks are um interested in oscow, which is and if you're not interested in oscow, you're or you're, not familiar oscow is just a a potentially a way to it's. An open um security controls, assessment, language I think it's something like that. Anyway, the the basic idea is is a way to sort of take stuff like security controls and security control assessments and codify it into a structured language like Json, XML, Etc and then be able to say great.

A

You know now you can just sort of automate control assessments and and so on, and so that's kind of tied in here.

A

um There is a lot of collaboration with uh salsa, which is an open, ssf standard.

A

um You know there's a lot of folks who you know myself included, who contribute to salsa as well as this and there's a lot of um sort of collaboration back and forth around stuff, like definitions, so definitions in salsa, site, stuff in cntf and stuff that cncf is doing is, is looking back at stuff that that salsa is doing to to help out there as well um yeah and then just for folks who are interested.

A

If you, if you look at the nist ssdf, you know some of the controls uh are not I, don't think they call them controls I, think yeah, they call them practices and tasks, but some of the practices and tasks actually cite the cncf um secure supply chain uh best practices here as well.

A

Yeah I believe that is it uh yeah, that's all I all I have for now and if folks have questions- um or you know, want to know more and whatever feel free to to ask foreign.

A

Let's see um just as a having contributed to a bunch of these things, I just have links to them. um I can add them into the the slides and make sure that the slides are instead.

A

Oh yeah yeah, they are in the GitHub issues, but sometimes that's not the easiest to oh the um tag, security issues. So if I go back to here, um I believe so. For example, for Marina's thing there is a cncf supply chain security tool, mappings one which cites that and then oh it looks like yeah. There is a controls, catalog.

A

The organization could be a bit better but um yeah, but there is a uh some stuff here in oops.

A

A

It's somewhere in there sorry.

A

uh Any other questions.

A

All right cool, well yeah, if there's a nothing else, um you know feel free to tap me on the shoulder. If you have any questions about, uh you know: tax security, the supply chain, security, working group um or any of the other sort of projects we are have worked on or we're planning to work on, or some of the things that we're doing with the openssf like salsa and Fresca, and all that good stuff foreign.