►
Description
Join us for Kubernetes Forums Seoul, Sydney, Bengaluru and Delhi - learn more at kubecon.io
Don't miss KubeCon + CloudNativeCon 2020 events in Amsterdam March 30 - April 2, Shanghai July 28-30 and Boston November 17-20! Learn more at kubecon.io. The conference features presentations from developers and end users of Kubernetes, Prometheus, Envoy, and all of the other CNCF-hosted projects
Intro: SAFE (A Cloud Native Security Working Group) - Liz Rice, Aqua Security
“Cloud Native” is open source cloud computing for applications — a complete trusted toolkit for modern architectures (CNCF presentation). There are multiple proposed projects which address key parts of the problem of providing access controls and addressing safety concerns. Each of these adds value, yet for these technical solutions to be capable of working well together and manageable to operate they will need a minimal shared context of what defines a secure system architecture.
To learn more click here: https://sched.co/FuLG
A
All
right,
thank
you
for
coming
to
this
this
little
session
this
afternoon
to
introduce
the
safe
working
group.
My
name
is
Liz
rice.
You
might
have
seen
me
earlier
on
the
keynote
stage.
I
am
technology
evangelist
with
aqua
security
and
I'm
also
involved
with
this
safe
working
group,
which
is
still
relatively
new
and
establishing
itself
so
yeah.
A
In
fact,
we
are
not
technically
an
officially
approved
working
group
yet,
but
we're
very
much
expecting
to
be
so
any
day
now,
so
some
very
good
code
gets
written
by
people
who
don't
necessarily
know
very
much
about
security,
and
so
sometimes
security
gets
sort
of
deferred
to
late
stages
of
a
project
or
isn't
often
not
a
priority.
In
the
early
there
are
early
days
of
a
project
and
also,
if
we
think
about
the
building
blocks
of
cloud
native
components,
we
need
to
be
able
to
operate
the
whole
stack
in
a
secure
and
safe
way.
A
We
need
to
be
able
to
keep
our
end-users
data
safe
come
on
in,
and
we
need
to
know
that
we're
not
going
to
lose
personal
information
that
we're
not
going
to
allow
people
to
hack
our
deployments,
we're
not
going
to
allow
people
to
use
our
resources
unapproved,
so
security
is
really
important.
Safety
of
data
is
really
important,
but
for
all
sorts
of
reasons,
whether
it's
knowledge
or
a
lack
of
confidence,
often
security
doesn't
really
get
considered
right
at
the
get-go.
A
A
Yes,
so
you
can
go
to
that
github
repo
and
see
where
we
are.
The
original
founding
team,
JJ
from
Twitter
he's
now
moved
to
Tet
rates
and
Sarah
from
Google.
Pretty
much
had
the
idea
at
cube
corn
cloud
native
corn
in
Austin
last
year
so
roughly
a
year
ago,
and
then
they
were
quickly
joined
by
Dan
Shaw
who's
just
recently
started
at
PayPal,
but
these
people
have
a
lot
of
experience
and
have
some
really
good
ideas
around
communicating
and
collaborating
on
security
across
the
cloud
native
Zak.
A
A
We
want
people
to
be
able
to
understand
what
sort
of
security
features
different
projects
are
bringing
to
the
table.
So
there
are
some
projects
that
actually
add
security
features
in
a
cloud
native
stack,
for
example,
things
like
spiffy
or
which
gives
identity
or
notary
and
tough,
which
help
with
the
signing
of
images.
So
we
want
to
make
it
easier
for
people
to
unpack
these
projects
fit
in
the
cloud
native
landscape.
A
We've
identified
that
compliance
is
actually
a
really
it's
a
big
challenge
for
a
lot
of
users
of
cloud
native
software,
so,
for
example,
if
they
need
to
meet
things
like
PII
GDP,
our
FedRAMP
for
the
US
government,
there
are
all
sorts
of
compliance
regulation.
But
if
you
take
a
cloud
native
stack,
you
deploy
kubernetes
and
the
other
pieces
around
it.
A
We'd
like
to
be
able
to
help
CN
CF
project
understand
their
position
in
relation
to
things
like
compliance,
so,
for
example,
I
mean
a
really
basic
example
would
be
that
and
gdpr
requires
you
to
encrypt
data.
Certainly
at
least
it's
in
storage,
it's
kind
of
sketchy
on
whether
or
not
you
really
have
to
encrypt
it
in
transit
and,
if
you're
a
project
that
has
anything
to
do
with
storage.
A
A
There
are
things
like
the
C
is
the
Center
for
Internet
Security,
who
have
guidelines
that
relate
to
cloud
native
projects,
while
certainly
for
kubernetes
and
docker,
so
having
a
well-defined
path
for
to
communicate
between
those
different
bodies
and
the
CNC
F
seems
to
be
a
good
idea,
and
so
basically
I
mean
this
is
a
super
fast
run-through
of
what
we're
what
we're
there
to
achieve,
but
basically
we
would
love
to
see
more
people
joining
I
could
probably
start
again,
there's
like
a
whole
new
crew.
Coming,
that's
okay,
thank
you
for
going.
A
You
know
what
I
will
I
will
go
back
a
bit
because
we've
just
got
like
double
the
audience,
so
I'm
going
to
rewind
a
bit
so
the
safe
working
group.
It
stands
for
secure
access
for
everyone,
and
the
idea
is
to
help
their
cloud
native
projects
think
about
security
in
a
consistent
way
and
to
communicate
it
in
a
consistent
way
to
end
users
and
then
to
help
end-users
understand
how
to
operate
their
cloud
native
stack
in
a
secure
way.
A
So,
if
you
think
about
pulling
together
all
the
different
CN
CF
projects,
all
these
different
building
blocks
at
the
moment
there
isn't
a
sort
of
consistent
place
to
talk
about
securely,
operating
those
components
and
yeah.
We
have
about
20
different
organizations
currently
represented
in
the
working
group,
and
these
are
kind
of
three
main
initiatives
that
we've
been
working
on.
One
is
a
landscape
to
try
to
understand
what
the
security
best
practices
should
be
in
a
cloud
native
environment
and
how
those
map
to
the
different
projects.
A
So,
for
example,
some
of
the
projects
like
spiffy
or
notary
are
directly
off
link
Rd
as
a
service.
Mesh
they've
got
some
directly
security
related
features,
or
they
may
be
absolutely
about
security,
and
we
want
to
help
users
understand
how
to
occur,
how
those
different
components
play
a
part
in
securing
their
cloud
native
deployment.
A
We
want
to
help
operators
of
cloud
native
snacks
understand
how
to
meet
compliance
and
regulatory
requirements,
and
we
also
want
to
kind
of
standardize
how
different
projects
get
or
they
get
a
security
audits
from
the
CN
CF.
It's
one
of
the
benefits
of
the
CN
CF
being
a
CNCs
project,
but
we
felt
that
there
could
probably
be
a
little
bit
more
common
understanding
of
what
those
security
audits
should
be
and
what
they,
what
passing
the
audit
really
mean.
A
So
yeah
diving
a
bit
into
the
compliance
part
again.
This
is
the
idea
that,
if
you
need
to
operate
a
cloud
native
stack
in
compliance
with
one
of
these
standards
like
PCI
or
FedRAMP
or
HIPPA,
there
are
lots
of
different
organizations
who
are
going
through
the
same
challenges
who
also
have
to
meet
these
compliance
requirements.
And
we
should
try
and
have
a
centralized
body
for
thinking
about
how
to
configure
your
cloud
native
snack
to
meet
those
requirements.
A
Think,
as
we
have
more
and
more
projects
under
the
CN
CF
umbrella,
it
will
be
important
to
identify
when
they
impacts
on
these
compliance
requirements
and
helps
the
projects
communicate
to
their
users.
How
to
meet
compliance
requirements
and
then
the
safe
working
group
can
also
be
a
kind
of
central
point
of
communication
between
the
CN
CF
and
these
security
related
standards
bodies
and
security
related
organization.
A
So
for
the
the
people
who
just
came
in
we,
we
aren't
technically
yet
an
official
CN
CF
working
group,
although
we
expect
that
to
happen
any
minute
now
so
for
the
time
being,
we're
still
on
github
at
CN
security,
nothing
to
do
with
China
done
that
joke
twice
now
so
cloud
mates
with
security,
/
safe.
That
will
obviously
move
under
the
sense
EF
any
day.
Now
we
have
a
well
a
working
group.
We
do
actually
at
the
moment
we've
got
two
weekly
meetings
happening
on
Thursdays
and
Fridays.
A
Yes,
so
the
working
group
will
eventually
end
up
as
WG
safe
under
the
Cynthia.
We've
got
a
slack
channel,
we're
very
keen
to
recruit
some
new
members
and
I
think
at
the
moment
we're
still
getting
off
the
ground.
It's
still
very
early
days.
So
if
you
have
an
interest
in
security
and
compliance
now
is
a
really
good
time
to
to
get
involved.
A
We
have
all
these
sort
of
ambitions
to
be
to
be
able
to
talk
about
security
in
a
consistent
way,
but
there's
going
to
be
quite
a
lot
of
work
involved
in
doing
that
and
I
think
also
to
figure
out
how
the
different
projects
meet
compliance
requirements
and
meet
security
requirements
is
going
to
be
a
significant
amount
of
work.
So
we'd
love
to
have
more
people
involved
in
this
group
so
that
it
is
a
super-fast
run-through
of
what
the
safe
working
group
is
there
to
achieve
and
I.
Think
at
this
point.
A
B
So
understand
that
it's
kind
of
a
compliance
based,
but
I
also
understand
that
you
can
also
meet
compliance
with
multiple
types
of
solutions.
So
it's
the
idea
kind
of
delaying
the
technology
to
compliance
or
just
to
kind
of
make
a
best
dis
of
like
Fatih,
make
best
practices
that
can
be
maritime
yeah.
A
I
think
it
would
be
more
like
a
set
of
best
practices
and
understanding
how
these
pieces
fit
together.
So,
for
example,
in
the
cloud
native
lands,
you
know
that
landscape
they've
got
with
the
15
million
projects
on
it,
and
quite
a
lot
of
those
projects
have
some
relationship
to
security.
Some
of
them
are
all
about
security.
Some
of
them
have
some.
You
know
if
you
didn't
configure
them
right,
they
would.
That
would
really
dramatically
affect
your
security
posture,
and
that
seems
like
a
pretty
confusing
thing
to
present
end-user.
A
So
we
want
to
try
and
clarify
that
for
end-users,
exactly
how
we
do
that
and
how
we
present
that
information
is
totally
up
for
grabs
at
this
point,
I
mean
you'll,
see
if
you
go
to
the
github
repo
we've
got
things
like
some
use
cases
and
personas,
and
some
sort
of
starting
points
of
the
outputs
that
we'd
like
to
generate
related
to
things
like
compliance,
but
we
don't
yeah
dummy
need
final
deliverables.
Yes,
so
the
time
is
right.
Hi.
C
Hey
you
know,
like
within
large
organizations
a
lot
of
security
teams,
don't
have
a
good
understanding
of
how
cloud
native
applications
work,
and
how
can
you
do
security
on
a
container
bases?
They
have
like
a
more
traditional
firewall
approach.
Security
so,
like
this
work.
Group
also
wants
to
to
make
it
easier
for,
like
security
teams
on
the
large
organizations
to
understand
how
they
can
approach
security
at
a
cloud
native
application.
A
A
A
A
A
A
Security
of
a
container-
it's
a
yeah-
well,
yes,
I
think
we
should,
because,
partly
if
we
think
of
it
holistically,
you
know
if
we're
dealing
with
the
security
team
from
a
traditional
organization,
we
need
to
be
able
to
explain
to
them
that
what
the
security
implications
of
moving
to
containers
are
and
how
they
can
do
that
safely
and
also
just
the
existence
of
things
like
container
D
as
a
CNCs
project.
I
mean
we're.
Definitely
that's
in
the
scope
of
the
scenes.
Yeah,
so
I
think
talking
about
the
container
security
is
appropriate
yeah.
My
my.
D
B
A
Vulnerabilities
have
been
found
and
patched,
and
there
are
things
you
can
do
to
make
a
container
really
unsafe.
You
can
mount
the
hosts
root
directory
into
it
and
that's
a
really
bad
idea,
but
you
can
do
it
and
then
you
can
say
well.
Actually
I
would
rather
have
a
different
level
of
isolation
and
then
things
like
nabla
come
into
it.
Orgy,
visor
and
and
but
gee
miles
have
just
had
a
vulnerability
two
weeks
ago.
So
like
there
is
no
code,
that's
safe
right.
B
E
A
B
So
the
I
think
that
the
thing
that
at
least
we
did
in
their
research
and
IBM
was
that
that
is
basil,
there's
always
whether
using
a
hypervisor
using
a
container
right.
There
is
always
this
Louis
privileged
component
that
you're
using
right,
and
so,
if
you
imagine
any
kernel
exploit
right,
whether
you
isolate
the
resources
or
anything.
If
you
are
able
to
exploit
the
load
of
a
privileged
component,
then
you
break
isolation
and
IG.
B
E
B
Using
heuristics
and
stuff
like
that,
so
I
mean,
if,
if
you
imagine,
every
container
workload
that,
if
I
specifically
found
a
very
small
set
home
profile
for
every
container
I,
could
basically
minimize
my
risk
of
exploitation.
So
so,
for
example,
if
you
run
every
front
sea,
but
you
only
have
a
you,
have
you
run
only
services
which
use
maybe
five
six
calls
right?
Then
you
can
imagine
that
your
exposure
runs
running,
run,
see
with
that
specific
container
workloads
on
that
host
compared
to
another
holes
with
a
different
set
of
data
workloads.
A
And
I
think
also
the
point
about
isolation.
Requirements
will
vary
from
organization
to
organization
like
if
you
have
a
multi-tenancy.
You
know
that's
a
different.
You
have
different
isolation
concerns
than
if
you
are
you
know,
if
you
can
trust
every
user
on
the
on
the
same
house,
you
have
different
isolation,
require
yeah.
B
C
A
A
No
I
can
talk
about
fun,
I
like
that
yeah,
okay,
so
yeah.
We
would
really
love
to
have
more
people
participating
in
the
working
group,
and
you
know
as
I
say
it's
very
early
days,
so
helping
set
the
direction
and
figure
out
what
our
priorities
should
be.
You
know,
like
everything
else
in
this
community
is
done
by
people
deciding
that
that's
what
they're
interested
in
so
we'd
love
to
have
more
people
involved,
any
other
questions
or
thoughts
or
contributions.
A
A
A
E
A
That's
I
think
that's
pretty
much
everybody
who's
I
mean
they're.
In
many
cases,
it's
one
person
from
each
of
these
organizations
at
this
point
but
yeah
it's
clearly.
A
lot
of
a
lot
of
companies
are
interested
in
security
and
they're
interested
in
you
know,
building
a
more
circuit
for
all
of
us,
I
think
being
able
to
help
raise
the
level
of
security
across
our
native
components.
It's
good
for
everyone.