►
From YouTube: A Sneak Peak Into Security Reviews with the Community - Ragashree MC, Carnegie Mellon University
Description
Don't miss out! Join us at our upcoming event: KubeCon + CloudNativeCon Europe in Amsterdam, The Netherlands from 18 - 21 April, 2023. Learn more at https://kubecon.io The conference features presentations from developers and end users of Kubernetes, Prometheus, Envoy, and all of the other CNCF-hosted projects.
A Sneak Peak Into Security Reviews with the Community - Ragashree MC, Carnegie Mellon University
In this talk, we explore the need for open source security reviews, how they are different from audits, and how they are used. We will share the TAG contributions with respect to the upcoming Security guide and provide a sneak peek into its contents. Finally, we also start the dialog on to get onboard and involve in the development of this guide
A
We
wrote
a
book,
we
wrote
a
book
about
all
the
security
assessment
activities.
We
are
doing
what
are
the
things
that
is
covered
in
these
activities
and
how
you
can
get
some
goodness.
So,
let's
dive
into
it
I
mean
What
a
Wonderful
World.
Today,
isn't
it
at
least
for
the
last
two
days,
I've
heard
and
listened
and
been
part
of
so
many
activities,
and
it's
so
overwhelming
everything
is
connected,
and
this
Innovation
everywhere
I
think
it's
the
best
time
to
be
here
around
and
be
here
in
Silicon
Valley
that
that's
so
awesome.
A
This
is
not
Silicon,
Valley
I
understand
San,
Jose
and
San
Francisco,
and
these
times
are
but
I
just
came
from
India.
So
please
bear
with
me,
but
in
the
same
context
there
are
also
a
lot
of
things
connected
and
the
attack
surface
is
increasing
more
than
ever,
and
that
means,
if
anything,
is
in
fact
indeed
kinda
compromised.
Then
all
of
us
are
in
soap
and
lock.
A
4J,
for
that
matter
was
a
really
good
example
to
show
that
if
everything
is
connected
and
if
everything
is
in
fact
the
way
it
is,
we
need
to
be
really
careful
about
what
we
are
doing
in
the
first
place
and
it
is
important
to
understand
how
secure
are.
We
really
are
and
memes
kind
of,
like
this
kind
of
make
me
scared
most
of
the
time,
and
it
says
that
if
any
project
is
not
looking
into
Security
in
the
first
place
and
they
just
build
and
look
into
their
features
and
ship
something
and
then
see.
A
Oh,
my
God.
How
did
we
get
hacked
that
kind
of
makes
me
really
really
weird
and
scared
for
the
rest
of
my
life?
So
that's
one
of
the
reasons
why
I
joined
tax
security
because
you're
not
alone
in
this
process,
there
is
a
lot
of
help
available
for
you.
There
is
a
lot
of
help
in
terms
of
what
you
should
be
doing
and
how
you
can
actually
do
them
in
terms
of
tools
and
mappings
and
guidelines
and
everything,
and
that
has
also
help
to
see
if
you've
done
it
the
right
way.
A
We
also
have
a
particular
team
of
volunteers
to
actually
help
you
go
through
the
security
assessment
in
terms
of
self-assessment,
joint
reviews,
and
things
like
that
and
shout
out
to
one
of
my
colleagues
and
volunteers
here
is
giving
a
talk
in
about
45
minutes.
So
please
feel
free
to
go
to
that
talk
and
see
all
the
goodness
that
we
are
providing
as
part
of
tax
security.
A
But
then
we
also
thought:
how
can
we
actually
supplement
all
these
goodness?
How
can
we
help
you
verify
what
you
did
was
in
fact
right,
and
how
can
we
help
you
verify
at
the
earliest?
What
you
did,
or
what
you're
going
to
do
is
indeed
right
and
that's
where
we
want
to
introduce
you
to
security
assessments.
A
A
And
it
started
as
part
of
like
Andy
said
it
started
as
part
of
a
part
of
lightweight
threat
modeling,
because
we
had
the
very
good
process.
But
there
were
certain
experts
who
knew
what
the
need
to
be
done
and
if
I
wanted
to
join
I'm
a
student
right
now,
I
did
a
bit
of
my
engineering
and
Enterprise
experiences
before
but
I'm
a
student
right
now,
if
I
want
to
join,
how
do
I
really
get
started?
A
Who
tells
me
what
I
need
to
do
and
that
was
not
very
transparent
before,
and
that
was
primary
reason
why
we
started
this
project.
So
all
of
us
get
a
clear
visibility
of
what
is
happening
and
what
needs
to
be
done
and
kudos
to
our
primary
author
Justin
kappos.
He
couldn't
be
here
with
us
today,
but
he
is
wishing
us
the
best
from
China.
A
So
thank
you
Justin,
and
we
want
to
make
this
a
community
resource
we're
looking
for
feedback
from
all
of
you
in
terms
of
what
you
need
and
if
we
are
addressing
everything
you
need
and
if
there
is
any
scope
for
improvement,
do
feel
free
to
reach
out
to
us
now,
let's
dwell
into
what
all
the
goodness
is.
All
about.
A
It's
it's
to
give
a
holistic
view
on
what
are
the
things
that
you
are
doing
and
is
it
actually
aligning
with
the
goals
of
security?
In
terms
of
your
project,
it
Dives
deep
into
the
systemic
and
the
design
related
issues,
not
necessarily
the
implementation
and
provided
your
architecture
doesn't
change
drastically.
It
does
stay
for
a
longer
time.
A
It
sounds
more
similar
to
audits
right,
but
then
audit
has
fewer
Minor
Details.
That
is
what
makes
it
different
from
assessment.
So
audit
really
looks
into
the
implementation
issues
it
doesn't
really.
It
does,
but
not
specifically
meant
to
look
into
a
systemic
or
design
related
issues
and
audit
provides
you
a
snapshot
of
your
security
posture
at
that
point
in
time,
with
the
addition
of
Minor
Details
and
new
lines
of
code,
that
posture
may
change
as
the
project
progresses,
but
security
assessments.
A
On
the
other
hand,
it's
meant
to
be
valid
for
a
longer
Direction
until
you
really
change
your
architecture
or
revamp
your
project
as
a
whole.
Now
how
to
actually
perform
a
security
assessment.
To
do
that,
you
need
to
know
what
you're
protecting
you
need
to
know
what
your
assets
are.
You
need
an
assets
are
something
that
brings
value
to
you
and
you
have
control
to
do
something
now
say,
for
example,
I
want
to
create
a
website.
A
I
host
it
in
some
cloud
provider,
I
use,
DNS,
I,
use,
routing
Services
I
use
my
ISP
to
actually
route
my
traffic
to
the
web
server
in
this,
something
that
is
of
value
to
me
and
which
I
have
in
my
control
to
actually
do
something
about.
It
is
my
web
server
and
my
web
application
other
than
that.
I
can
change
a
few
things,
but
not
necessarily
dwell
deep
into
how
they
are
implemented
and
make
changes
over
there.
A
So
understanding
what
are
assets
are
and
how
they
interact
with
each
other
is
something
really
important
and
assets
need
not
be
just
intangible
ones.
It
can
be
tangible
ones
as
well
so
differentiating.
What
is
that
that
is
important
for
us
and
how
they
interact
with
each
other
in
terms
of
data
flow
diagrams
among
many
others,
that
becomes
very
important
once
you
know
you,
what
your
assets
are.
Understanding
who
the
actors
are
that
is
associated
with
the
asset
is
another
secondary
Factor.
A
So
there
are
actors
who
increase
the
security
posture
of
your
asset,
and
there
are
actors
who
try
to
decrease
your
security
posture,
and
then
there
are
also
actors
who
supplement
it.
Based
on
their
activities,
it
can
enhance,
or
it
can
decrease
so
understanding
who
these
actors
are
is
kind
of
very
important.
A
Now,
once
you
know
your
asset
once
you
know
the
actors,
you
need
to
also
understand
what
are
the
goals
for
your
system?
Is
it
confidentiality?
Is
it
Integrity?
Do
you
want
it
to
be
available
all
the
time?
What
exactly
is
the
goal
for
your
system?
Now,
for
example,
governments
may
be
very
careful
and
they
may
be
very
conscious
about
protecting
their
information
and
making
it
very
confidential.
A
On
the
other
hand,
Facebook
and
Google
and
availability
may
be
very
important
for
them,
because
even
one
hour
of
downtime
or
even
one
minute
of
downtime
will
bring
a
loss
of
huge
amount
of
revenue
for
them,
and
these
the
CIA
Triad
is
considered
the
holy
Triad.
But
it's
not
necessarily
enough.
There
is
also
other
secondary
factors
such
as
authentication,
non-repudiation,
secrecy,
privacy
and
other
factors.
A
On
the
other
hand,
the
attackers
are
very,
very
interested
in
bringing
down
all
our
goals,
so
they
may
be
interested
in
disclosing
our
sensitive
information,
altering
our
assets
and
making
hampering
our
integrity
and
distracting
our
services
and
bringing
down
the
availability
so
understanding
what
the
attacker
goal
may
be,
and
what
is
that?
Your
primary
concern
will
help
you
in
mitigating
all
the
risks
you
know
from
the
assets
assessment
perspective
itself.
There
are
three
primary
goals
in
terms
of
assessment.
A
You
need
to
identify
what
your
threats
and
risks
are,
and
then
you
need
to
categorize
based
on
the
impact
and
then
respond
based
on
what
is
that
is
most
important
for
you
from
the
identification
perspective
if
you've
been
in
the
previous
talk,
you've
heard
in
lens
and
depths
about
this
thing.
There
is
several
modules
that
is
available
and
methodologies
and
Frameworks
that's
available
for
you
in
terms
of
what
actually
is
in
threat
for
the
service
or
the
application.
A
So,
basically,
in
terms
of
identification,
we
we
need
to
know
what
are
the
threats
that
is
possible
for
the
service
and
to
know
that
we
already
went
through
the
actors
and
assets
that
is
important
for
us
and
among
the
various
Frameworks
Andy
talked
about
stride,
but
there
are
also
other
things
like
pasta,
tried
and
octave
and
Linden
that
is
newly
available
for
privacy
So.
Based
on
what
approach
your
organization
is
taking,
is
it
a
risk-based
approach?
Is
it
attacker-centric?
A
Is
it
developer
Centric,
you
can
choose
the
relevant
model
for
your
identification
and
then
work
upon
the
threads
accordingly.
So
now
in
the
cloud
native
Community,
we
are
mostly
developer
Centric
and
we
are
very
focused
on
our
community
and
stride
is
one
such
developer-centric
model
that
helps
us
identify
the
threats
and
help
in
the
mitigation
steps.
So
we
in
this
book
we
talked
more
about
stride
framework,
so
stride
basically
stands
for
it's
an
abbreviation
for
spoofing,
tampering,
repudiation
information,
disclosure,
denial
of
service
and
elevation
of
privilege.
A
When
we
want
to
discover
any
threats
that
is
applicable
in
our
environment,
it
can
be
fitting
into
one
of
these
buckets.
So
if
there
is
no
TLS
no
encryption,
then
it
is
hampering
our
information
disclosure
and
it's
actually
Bringing
Down
the
confidentiality
and
things
like
that.
So
this
is
how
we
can
identify
what
really
matters
for
us
and
how
threats
are
impacting
our
product.
A
A
Now
we
know
there
are
high
severity,
medium
severity
or
low
severity
threats
and
how
we
respond
to
those
threats
is
very
important
in
terms
of
if
there
is
a
possibility
to
prevent
something.
Let's
prevent
it,
let's
not
put
some
patch
and
just
make
it
something
like
a
immediate
thing,
let's
think
about
the
long
term,
and
if
there
is
a
preventative
measure,
let's
do
that,
but
if
there
is
no
preventative
measure,
that's
available
at
least
let's
recover
from
it.
A
If
there
does
happen,
some
damage,
let's
recover
from
that
damage,
if
that's
also
not
possible,
let's
detect
that
some
damage
has
happened
and
Trace
the
whole
source
of
it.
If
there's
no
traceability
at
least
let's
detect
it,
but
otherwise
at
least,
let's
do
some
traceability.
So
this
is
how
the
prioritization
works.
So
we
prevent
it
if
not
possible,
let's
recover
and
if
that's
also
not
possible,
let's
at
least
detect
with
some
traceability.
A
So
we
did
supplement.
We
wrote
a
big
book
about
it
to
verify.
If
what
you
did
is
right
or
how
we
can
verify
at
the
earliest.
What
you're
doing
is
right
now.
This
is
already
a
process
in
tax
security.
We
we
have
a
big
process
for
all
the
projects
that
is
going
from
sandbox
to
incubation
or
entering
sandbox,
or
you
want
to
go
to
graduation.
So
what
we
recommend
is
First
Step
as
performing
the
self-assessment.
So
there
is
a
lot
of
material
that
is
available
in
our
repository.
A
A
So,
to
get
one
such
assessment,
you
can
initiate
a
joint
review
request.
You
can
add
an
issue
in
our
tag.
Repository
all
of
the
links
are
given
here
and
the
slides
will
be
shared.
So
you
can
issue
one
of
one
such
issue
in
our
repository
and
we
as
reviewers.
We
sit
together
and
see
if
there
is
a
conflict
of
interest
and
we
declare
that
conflict
of
interest
and
see
get
together
who
are
not
having
any
such
conflicts.
A
These
are
the
folks
who
have
done
awesome,
work
in
tax
security
assessment,
Justin,
capos,
Matthew,
Kisa,
Andrew,
Martin
and
other
Tech
contributors
who
have
really
spent
a
lot
of
time
in
helping
increase
our
posture
and
as
a
community.
So
that's
really
awesome
now,
what's
next
it
you
know,
there's
a
book
now
I
literally
walked
like
I
talked
too
much
now,
so
how
how?
How
can
you
get
involved?
So
if
you
have
any
feedback,
go
through
go
through
the
book.
A
First,
if
you
have
any
feedback,
anything
that
is
missing,
anything
that
could
be
done
differently
or
any
major
things
please
feel
free
to.
Let
us
know
we
are
more
than
happy
to
inculcate
the
feedback
and
for
folks
who
have
already
gone
through
this
process.
If
you
have
any
commentary,
expert
commentaries
or
feedback
you
want
to
include
in
that
book,
please
feel
free
to
reach
out
to
us.
A
We
chat
in
the
tax
security
assessment
slack
channel
in
the
cncf
workspace,
and
we
have
come
together
a
teeny
bit
of
guidelines
for
engagement
so
that
we
accelerate
this
process
and
not
stick
together
with
small
nitty
gritties.
So
we
try
to
focus
as
much
on
the
high
level
problems
and
omissions
and
we
welcome
any
expert
commentaries
and
feedbacks
from
the
community
and
to
maintain
the
uniformity
and
single
voice
in
the
book.
Some
of
the
modifications
may
be
paraphrased
by
our
primary
author.