Cloud Native Computing Foundation CloudNativeSecurityCon 2023 - Seattle, 3 Feb 2023

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: TAG Security Cloud Native Security Whitepapers Overview - Shlomo Zalman Heigh, CyberArk

Description

Don't miss out! Join us at our upcoming event: KubeCon + CloudNativeCon Europe in Amsterdam, The Netherlands from 18 - 21 April, 2023. Learn more at https://kubecon.io The conference features presentations from developers and end users of Kubernetes, Prometheus, Envoy, and all of the other CNCF-hosted projects.

TAG Security Cloud Native Security Whitepapers Overview - Shlomo Zalman Heigh, CyberArk

There are many aspects of Cloud Native Security, and it can be daunting to approach. To help security practitioners understand cloud native security, TAG security has published multiple whitepapers and reference architectures to help provide context on securing cloud native infrastructure. In this talk, we will go through what’s out there and coming up, including the Cloud Native Security Whitepaper, Supply Chain Security best practices and reference architecture, Zero Knowledge whitepaper as well as the Cloud Native Security Controls mapping. We hope that this session will lighten the pathways into cloud native security for all

A

Thanks everyone for coming to this session, it's I know it's the very end of the conference and everybody's hired so appreciate you sticking around long enough.

A

uh Purpose of this talk is to get introduced to the cncf tag, security and learn about some of the Publications and initiatives that it's involved in and also how you can get involved as well.

A

A lot of this work was already done for me during the keynote and during previous sessions as well, so uh my show of hands everybody at this point understand what the cncf tag security is.

A

The most part, okay, so I'll give a brief overview, but first a little bit a little bit about me. I'm I work as a senior software engineer at Cyber, Arc I work on conjure, which is an open source. Secrets manager um used for securing machine identity and in Cloud environments, and my role aside from regular feature.

A

Development on the product, engage with open source community and lots of Upstream contributions specifically to philosophy projects and tax security, which is what brings me here and my spare time, I like to spend time with my wife and four-year-old daughter, I tinker with 3D printing fly, RC planes and woodworking projects and I'm always happy to connect with new people. You can find me on LinkedIn and GitHub.

A

The links are on the slide or you can come talk to me afterwards, I'm here until the end um and I've been involved with the tax security for about a year now, I think I got more involved after this last kubecon in Detroit, where I got to meet a lot of the members in person which really helped jump start that and I I really like that. These conferences allow us to meet people in person and understand how we can get involved.

A

It's very it's a very different meeting people on a get up issue, as opposed to at a conference in person. So I really appreciate that um we do something a little bit different I'm gonna shout out to a certain cncf initiative, which is not really part of the tag security, but I love it and I. Just have to give it mention. um Is everybody aware of fippy wow people are really missing out.

A

um This is the Illustrated children's guide to kubernetes. Then have people heard about this wow? Okay, a lot more people need to know about this. um This is me reading my daughter, her favorite bedtime story and it is her favorite. um So those of you don't know about this book. You can check it out at 50. IO, it's a cncf page. They also sell these squishies and plushes of the characters and they're a bunch of other books and in fact, if you start educating them early, you could we'll see if this works.

A

You can get this out of it. What's your favorite container orchestration platform.

A

Okay, let's get on in Okay, so tag stands for technical Advisory Group. The cncf has a large number of technical advisory groups. Well, I, don't know what the number is, but there's several, and this is obviously the one that deals with security.

A

We are Developer focused group. We want to enable developers, as opposed to blocking them we're volunteers from all backgrounds all over the world and we try to strengthen Security in the cloud native ecosystem through education, Security reviews of cncf projects, which was covered in a previous talk by Raga and by Andy Martin publishing resources to help everyone involve the con native landscape, which is what this talk is going to focus on specifically and also conferences like this one.

A

This is a project of tag security and the previous Cloud native security kinds and uh security days that were the predecessor to this conference that you heard about this morning at the Keynote we run everything via our GitHub repository cncf tag security.

A

We meet once a week on zoom on Wednesdays every other week. We so every one week we meet within a U.S time zone. Alternate week. We meet in an emea friendly time zone and meetings are recorded, live streamed and we have notes so you can follow along. You know: what's going on everybody's, welcome, to come to meetings and and uh and get involved in conversations, and we have different working groups for different projects that we work on here is a leadership team.

A

All these species faces were on the keynote slide this morning, so I won't go over too much so I'll gloss over this a bit. What let's get into what we do, though we have a lot of different initiatives and we've had in the past, uh maybe had trouble communicating what all the things that we published are and how people can make use of them. So that's a portion of what this this talk is is intended to do, uh show what we have and what, how how it can help you and how you can contribute we.

A

So we published white papers, guidelines, best practices and then tooling, for things like assessments, so that we can allow projects to assess what they're doing if they're, following their best practices and whether they're doing things in the most secure way. We're not a government's body, and we do not do incident response. That's out of our scope.

A

A really main focus here is our Flagship white paper, which is the cloud native security white paper. Can I have a show of hands how many people have heard of the cloud native security white paper? Okay, some. We still have more work to do: okay, um okay, great. So this is a white paper that we have it's it's written by a lot of authors.

A

It's very much a community project, it's published as a PDF and in markdown, and we also have an audio recording for people who want to listen to it on their way to work or whatever else, washing dishes.

A

um White paper covers a ton of topics and it's contributed to and reviewed by and reviewed by by a long list of contributors. Community members includes different life cycle phases of the application development deployment runtime on and on and of course, as with anything in Cloud native things are always evolving, so we originally published version one, and then we immediately started a retrospective and started working on version.

A

Two and now we have version two published, and there are there's going to be a version three and there's opportunities to get involved in that which I'll cover a little bit more detail soon and the target audience is: is project teams who do Cloud native and want to make sure they're doing it securely. So I'm just going to show a brief I'm not going to go through the Hawaii paper, because it is long. But this is the table of contents just so you can get an idea of what it.

A

What what's in scope in the white paper, there's the different life cycle phases um and.

A

Goes by each by each phase: lots of information- if you want to drill down into something specific, a lot of content, is it's really great and, as I said, it's a PDF, but it's also available in markdown.

A

We have um translations, some of which are completed some arbitrary in progress and we're always open to to new ones.

A

We have I'm going to soon I'm going to show a list of GitHub issues and, as I mentioned, we run everything through regular repository and we have GitHub issues for version three already. So if anybody wants to get involved, you just post a comment.

A

There will tell you what you can help out with also we have our slack, which I'll show off soon, which will also uh also where we talk about these things and in our meetings so again, I'll Circle back to all that afterwards, in addition to this main Flagship white paper, we also have a few others. So we have this Supply software supply chain, best practices, white paper, which is obviously specifically about supply chain security.

A

We also have a few other things. We have a framework for evaluating your supply chain security. So if you follow white paper and then you want to see somewhat of like a checklist did I did we do this right? You can go through the here and uh you know, question answer and and see how you've done.

A

Another publication that we have, which is if you want to get involved with something this is pretty easy to get involved in pretty low barrier to entry. We have a catalog of supply chain compromises, supply chain, compromises are happening all the time and we wanted a. We wanted there to be a central location for people to look through research, analyze real world cases that have happened. Real supply chain incidents that have happened see if they can find things in common and learn, learn from them. So we created this list, that's published on our GitHub repository.

A

It goes back to um sure what year it goes back to. It goes out pretty far like 2003 or something the first like recorded supply, chain security attack and then all the way up till till now, if you know of one that's not listed, please submit a PR and if you're interested in supply chain security, which I mean maybe you're all sick of it by now after two days, but if you're not some for by some some miracle- you're, not sick of it. Yet um you can. You can learn a lot from from this list.

A

Great great way to get acquainted with real world impacts.

A

There's a lot of other projects, also a lot of projects in flight and we're always looking people to get involved. Here's a list of some of the GitHub issues that we're currently working on. If there's something that speaks to you go to that GitHub issue post a comment say that you want to contribute.

A

We can help, get you um on your way towards that and I'll show the slide again at that at the end, or you can take a picture of it now.

A

Another thing that I've I've talked to a lot of people here at the conference and something that I I've found interesting is that when people think about contributing to open source, they often think about writing code or things like that where they have to have or or they think they think it's difficult, because you need to understand, what's going on in a project to be able to write code or or to really understand the depths of it, something that people don't realize is that you can contribute to open source by doing very simple things.

A

I recently had a pull request for somebody who literally was fixing a grammar mistake or a spelling mistake in one of the white papers. That's valuable, that's extremely valuable and that's something that anybody can do and we encourage you too.

A

Another thing we do is we have. As I mentioned, we have our weekly meetings. You can show up show up to the meetings. The information about that is also on our data repository show up to the meetings and just be part of the conversation we also have.

A

Somebody needs to take notes at all the meetings that we have it's very helpful to have notes afterwards to go through if you missed a meeting or that kind of thing have a record of things besides for the video recording, but you know to have it in a shorter form if you want to get involved, show up to the meeting and offer describe meaning just take notes as we're going along and that's extremely helpful super useful one thing I wanted to give special mention on here, so lightweight threat.

A

Modeling was this was covered by Andy two sessions ago, and security assessments was covered by Raga one session ago and Kanye Square white paper we just talked about this- is the 3.0 the issue for 3.0. This is the audio which I'll talk about more in a second. We also have a zero trust white paper, which is in progress. Some of you may have met Assad faizi, who is not here right now, but he he's somewhere around and he's working on that. If you want to get in on that, it's almost finished.

A

In terms of the white paper, um I I, the audio, uh the story with the audio is that I personally and a lot of people don't necessarily have time to read or don't prioritize their time in such a way where they end up reading very much, but maybe they have commutes or they wash dishes or whatever, and they want an audio version. So what we've done is this is another way people can contribute without having to write a line of code.

A

Is we split up the white paper into sections and different people can read different sections record it and we put it on Soundcloud and anybody can listen to it.

A

Since the white paper is always a work in progress, so we had version one audio currently is up to version one. Now we have the white paper version two markdown and PDF generated from the markdown. The audio needs to be updated to version two. So that's something that we're working on now. Updating that eventually there's going to be version three and we're going to need that. So definitely something that if you have a voice, you can get involved in.

A

Okay, how do all these projects actually improve Security in the cloud native world.

A

Besides for Publications, we also do more in-person things, a big part of creating Cloud native Securities education and partnership, so we engage with projects and communities in both security related and non-secure related one of the goal. One of the roles of the tax security is when a project wants to move up in the cncf landscape. So we have a lot of sandbox projects. We want to move up towards graduated, they have to go through a Security review.

A

Tax security takes care of that. We provide ways of doing self-assessments security. Pals support for these projects in their Journey towards having a good security posture here are some presentations that we've done. This is another really cool thing. If you come to, the meetings is another. Another fantastic feature is that projects will put on presentations for us. They'll come and show show what they've done. Cubescape is a recently added cncf sandbox project. We got a great preview of this. They came and did a presentation.

A

We were able to ask questions, asked them why they did certain things and give them feedback. They can then go take that feedback work it into their product and improve the security same thing with there's a couple of other assessments. You can, you can I mean presentations, you, you can take a look at over here.

A

We also collaborate with other groups like The kubernetes Sig security, which should not be confused with tag security um sigs are are within kubernetes. Specifically, tags are cncf more broadly. We have a lot of overlap there, a lot of cross-pollination of ideas and openssf, which is here we work with them on some things. It's also on supply chain stuff, particularly.

A

And I sort of covered this we assist projects graduating through cncf levels. They present at a meeting. We ask them questions, Etc, gives more perspectives on a project and self-assessments and Joint reviews I'm not going to cover too much because that was covered previously and where can you jump in because this is open source?

A

So, first of all call to action. We have a supply chain security survey which we're conducting to understand how people relate to the supply chain, security and supply chain and how we can best help and what we can do to improve things. So please take this survey. If you haven't already some of you may have already. This is very, very helpful to us because we're trying to provide value to the community, so it would be very helpful for us to know what, where the gaps are, what people need what people are already doing.

A

What people are maybe not doing yet, maybe should be doing that kind of thing. So it'll be very helpful. Anybody take that survey. You can take a picture of the QR code, otherwise the slides will be on sketch and then just come. Join us, it's an open Community, you can come GitHub tag security.

A

We have a tax security Channel and the cncf slack workspace we're on Twitter. We have a mailing list. Zoom. You can watch our our stuff on YouTube and I'm, going to show the oh yeah in the meeting calendars available on on GitHub as well I'm going to show one new thing we just put out, which was a list of Publications I, didn't go through every single one of these in the slides, but we have a a list.

A

Oh there, we go our repository of things that we have published and there's quite a lot, there's something for everybody. Probably we have the cloud native security white paper as we talked about. We talked about this and this this is another another, a reference architecture. This I believe was mentioned at the keynote today or one of the other sessions. We have plenty of security lexicon which is great for just getting standard terminology, use cases, policy, stuff, secure, defaults for cloud native. This is a fantastic resource on creating secure defaults.

A

We have security controls catalog, which Maps the controls that we list in the cloud native security white paper to nist. So if you want, if you have to be, you want to work with with nist SB 800 you can.

A

um You can reference the white paper that we put out and and see where things where things align and then we have a bunch of security assessments, here's the ones that we've done so far and uh uh there's you know there'll be more obviously,.

A

Okay, here is the list of projects. Again, um people can get involved in and also I'm here, raga's here a few others are here. You can definitely reach out to us in person. If you want to get involved, that's what I did at Detroit and that's how I got involved in the audio project.

A

uh There's plenty of places for everybody, with all all from all backgrounds and all skill levels to get involved and help out with with tax security, and it's really a community the community effort to improve Security in uh in the cloud native world again. This is uh my information. If anybody wants to connect and that thank you.