►
From YouTube: Keynote: It Takes a Community to Raise a Conference: From Security Day to CloudNativeSe... Emily Fox
Description
Don't miss out! Join us at our upcoming event: KubeCon + CloudNativeCon Europe in Amsterdam, The Netherlands from 18 - 21 April, 2023. Learn more at https://kubecon.io The conference features presentations from developers and end users of Kubernetes, Prometheus, Envoy, and all of the other CNCF-hosted projects.
Keynote: It Takes a Community to Raise a Conference: From Security Day to CloudNativeSecurityCon - Emily Fox, Security Engineer, Apple
Our baby colo has grown up and ventured out on its own! How did this happen? They grow up so fast! In less than 4 years we’ve held 7 events in Europe and North America — reaching thousands of practitioners online and in person. All from a community member’s idea and the passionate volunteers that pulled together to make it real. Emily will share her experience coordinating Security Day - now grown into CloudNativeSecurityCon - and her aspirations for the future of this conference and cloud native security.
A
Hello,
everyone
I'm
Emily
Fox
for
those
of
you
that
are
familiar
with
me.
You
probably
see
me
pop
up
in
a
lot
of
different
open
source
communities.
In
addition
to
the
cloud
native
Computing
Foundation.
Today,
though,
I'm
going
to
talk
to
you
a
little
bit
about
the
history
behind
this
event,
for
those
of
you
that
have
been
in
the
cloud
native
security
for
a
while
now
you'll
know,
this
event
is
very
near
and
dear
to
me.
A
It's
basically
my
baby
I
love
this
event,
because
it
was
my
first
big
project
that
I
volunteered
to
assist
with
when
I
joined
the
open
source
community,
and
it
was
also
kind
of
the
first
time
I
had
heard
of
the
security
technical,
Advisory
Group.
However,
at
the
time
they
were
called
the
special
interest
group
for
security,
it
was
2019.
I
was
in
Barcelona
attending
kubecon,
Cloud
native
Con
Europe,
and
it
was
there
that
I
was
introduced
to
Cloud
native
security,
and
this
group
they
were
evaluating
the
security
posture
of
several
Cloud
native
projects.
A
A
In
addition
to
kindly
answering
all
of
my
barrage
of
questions
both
on
camera
and
off
camera.
He
mentioned
to
me
that
I
should
probably
check
out
this
group.
They
were
still
young
in
the
cloud
native
space.
The
foundation
was
still
kind
of
growing
and
ramping
up.
They
were
looking
to
break
new
ground
and
develop
new
practices
to
allow
us
to
apply
traditional
security
practices
into
Cloud
native
technology
stacks
and
really
Drive.
A
What
mattered
in
this
growing
community
space
and
as
always
open
source
is
always
looking
for
contributors
and
Technical
advisory
groups
and
special
interest
groups
are
no
exception.
So
you'll
hear
me
refer
to
them
as
the
security
tag
or
sync
security.
Throughout
this
talk,
but
ultimately
it's
the
same
group
of
fabulous
people,
so
I
started
lurking
in
their
meetings,
just
like
dialing
into
the
zoom
sessions,
trying
to
understand
a
little
bit
more
about
what
they
were
talking
about.
A
What
they're
trying
to
accomplish
reading
their
docs
asking
clarifying
questions
to
make
sure
that
I
understood
the
direction
that
this
group
was
heading
in.
They
had
a
ask
to
fulfill
their
mission
and
their
Charter,
but
enthusiastic,
encouraging
and
flexible
and
understanding
like
we're
still
trying
to
figure
a
lot
of
this
stuff
out.
But
ultimately,
what
we
needed
to
do
was
figure
out.
How
do
we
prevent
unauthorized
access
for
cloud
native
applications
and
workloads
in
a
way
that
makes
sense
for
all
of
the
adopters?
A
In
addition
to
the
maintainers
of
these
projects,
and
as
long
as
our
work
aligned
underneath
is
the
three
primary
focus
areas
of
the
charter?
We
were
Unstoppable.
The
charter
was
set
up
so
that
the
tag
could
fill
the
Gap
in
security,
guidance
instruction
and
tooling,
and
well
just
generally
provide
information
that
wasn't
there.
At
the
time,
organizations
were
leveraging
Heritage
and
checklist
security
requirements
completely
ignorant
of
all
the
possibilities
that
cloud
native
could
provide
from
a
security
perspective.
A
So
we
set
out
to
Define
how
to
protect
workloads
to
ensure
that
they're
still
usable
where
security
is
not
a
noticeable
hindrance
to
the
user
or
the
engineer's
workflow.
We
also
needed
to
figure
out.
How
can
we
take
the
existing
security
control
bodies
and
apply
those
principles
to
establish
a
common
understanding
and
corresponding
tooling
to
help
developers
really
meet
those
security
requirements,
but
perhaps
the
hardest
and
most
complex?
A
Yet
we're
still
trying
to
solve
is
how
do
we
break
down
the
complexity
in
audits,
because
Auditors
really
need
to
have
an
understanding
of
how
Cloud
native
architectures
are
supposed
to
be
developed,
built
and
operated
in
a
secure
manner?
Oh,
and
do
that
for
every
single
domain,
because
kubernetes
is
just
one
of
the
many
faucets
of
cloud
native
security,
and
you
can
make
an
argument
that,
due
to
the
Natural
complexity,
that
kubernetes
has
it
is
its
own
domain
of
expertise.
A
The
stickers
on
this
slide
are
just
a
couple
of
the
domains
that
we
still
need
to
do
explore
at
the
time
and
they
are
their
own
domain
expertise
areas
oh
and
we
had.
We
couldn't
really
fit
all
of
those
into
the
cubecon
cloud
native
con
security
track
and
talk
about
kubernetes.
At
the
same
time,
there
just
wasn't
enough
space
and
many
of
these
domains.
A
Hadn't
been
approached
from
a
security
perspective
in
2019,
we
needed
an
Avenue
and
a
place
to
explore
and
kind
of
Drive
content
along
these
areas
to
inform
adopters
and
maintainers
about
how
we
should
be
doing
Security
in
these
specific
areas.
We
needed
that
Avenue
to
build
up
Security
in
Cloud
native,
because
it
is
more
than
just
kubernetes.
It
is
a
multi-objective
multi-constrained
problem
space
with
a
lot
of
different
domains.
It
spans
the
entire
sdlc
and
whatever
comes
next.
A
We
have
to
be
prepared
for
it,
so
Michael
Ducey
one
of
our
community
members
at
the
time
who
he
had
previously
been
running
some
local
devops
days
and
was
really
into
the
open
space
scene.
He
filed
issue
number
209
in
June
of
2019
to
propose
a
one-day
event
that
went
beyond
the
current
security
track
at
kubecon.
There
were
14
of
us
that
jumped
on
board
for
that
issue.
A
We
had
a
lot
of
amazing
submissions
and
we
were
able
to
gather
to
pull
together
an
amazing
day
of
talks,
as
well
as
a
full
open
space
schedule
to
really
drive
a
lot
of
discussions.
Ian
Coldwater
in
Coldwater
and
Duffy
Cooley
started
our
day
off
as
a
throwback
to
kubernetes
talking
about
kubernetes
defaults,
and
how
do
we
move
forward
in
that
space?
A
If
you
look
back
at
the
first
open
space
schedule
in
the
first
Sig
security
day,
talks
you'll
find
a
lot
of
the
same
topics
that
we
talked
about
in
2019
are
still
being
talked
about
here
today.
But
the
difference
is
that
now
that
we
know
more,
we
can
share
a
lot
of
those
learnings
with
our
peers
and
colleagues
and
build
on
top
of
each
other's
learnings
and
you'll
also
find
out.
We
talked
about
software
supply
chain
security
attacks
before
it
was
cool.
A
We
talked
about
defaults,
we
talked
about
compliance
and
machine
learning
and
it
was
a
lot
to
cover
in
just
a
single
day
event.
It
was
a
huge
success.
The
program
committee
and
myself
and
the
other
colleagues
were
stoked
to
hold
another
one
and
make
it
bigger,
make
it
better.
So
in
2020
we
held
one
for
Europe,
because
we
wanted
to
ensure
that
the
European
audiences
security
concerns
and
Care
abouts
were
similar
or
at
least
addressed
within
this
conference
and
then
later
that
year,
because
that
one
was
a
success.
A
We
did
the
same
thing
for
North
America
in
20
and
2020..
What
we
did,
though,
is
after
that
initial
event.
We
performed
a
retrospective
to
really
understand
going
from
day,
one
to
the
second
event
and
the
third
event
to
get
community
members
feedback.
We
had
a
lot
of
interest
from
folks,
so
Twitter
chatter
was
strong,
excellent
discussions
by
community
members
and
the
open
space
Arena,
and
then
we
we
got
a
little
hint
that
people
wanted
something
a
little
bit
more
Hands-On.
They
wanted
workshops,
they
wanted
tutorials.
A
They
wanted
something
to
allow
them
to
take
the
theory
of
cloud
native
Security
and
apply
it
into
practice.
So
that's
what
we
decided
to
do
with
that
North
America,
we
held
a
CTF
and
it
was
fabulous.
If
you
were
here
yesterday,
you
heard
Andy
and
Andres
talk
about
how
we
executed
those
ctfs
and
how
our
community
members
responded,
and
that's
kind
of
been.
A
The
thing
with
a
lot
of
this
is
partnering
with
new
community
members
on
what
we
can
do
to
make
this
a
positive
experience
for
everyone,
making
sure
that
they
have
those
Lessons
Learned
and
that
they
can
take
them
back
with
them
to
their
companies
and
organizations
with
the
correct
skills
to
uplift,
their
overall
security,
showing
how
attackers
can
compromise
containers
in
a
fun
and
engaging
way,
and
it's
not
just
the
attendees
that
get
a
lot
of
value
from
this
event.
Individuals
that
run
these
events
and
participate
in
the
open
source.
A
Community
they're
leveling
up
their
skills,
they're
able
to
identify
gaps
and
challenges
being
experienced
by
adopters
through
discussions
with
their
colleagues
and
peers
and
hallway
tracks
or
in
open
space
talks,
they're
also
able
to
strategically
leverage.
Some
of
that
event,
content
to
drive
attendees
like
you
to
talk
to
each
other
figure
out.
What's
going
on
in
API
security.
How
did
you
all
solve
this
most
recent
vulnerability?
A
What
are
you
doing
to
improve
your
software
supply
chain
and
what
is
the
evolution
of
that
look
like
for
your
company
over
the
past
four
or
five
years,
because,
ultimately
we're
all
trying
to
do
the
same
thing?
Uplift
security
and
we've
been
able
to
increase
Industries
attention
to
security
and
Cloud
native
over
these
past
four
years
because
and
we're
going
to
continue
doing
it
because
there
was
and
continues
to
be,
a
gap,
and
while
that
Gap
is
significantly
smaller,
we're
still
growing
this
space
and
learning
and
uncovering
new
areas
to
explore.
A
You
can
see
from
the
metrics
on
this
slide:
we've
doubled
the
amount
of
security
projects
and
products
in
the
cloud
native
Computing
foundation's
landscape.
We've
increased
the
amount
of
Security
reviews
on
projects
that
we
had.
We
even
had
a
major
review
process
revision
and
we're
talking
about
doing
another,
one
to
really
drive
more
value
to
maintainers
as
well
as
adopters,
and
it's
because
of
the
First
Security
day
and
all
the
security
days
that
came
after
evolving
into
this
conference.
A
This
conference
is
an
Avenue
to
share
your
experience
and
to
learn
from
others.
I
would
like
to
see
it
continue
to
expand
Beyond,
just
Cloud
native
security
into
open
source
security,
because
both
of
these
are
complementary
fields
and,
as
we
see
more
maturity
in
Cloud
native
security
tools,
projects
guides
documentation
and
resources,
we're
seeing
them
applied
outside
of
cloud
native
architectures.
A
Cloud
native
security
forward,
connecting
members
solving
problems,
establishing
best
practices
and
sharing
what
we've
learned
I
want
you
all
to
take
this
opportunity
to
network
with
your
peers,
talk
about
some
of
the
challenges
you're
experiencing
and
how
you've
solved
them
as
a
throwback
to
the
original,
open
space
and
collaborative
nature
that
this
conference
started
from.
Thank
you.