►
From YouTube: Intro: CNCF Security SIG - Brandom Lum, IBM
Description
Join us for Kubernetes Forums Seoul, Sydney, Bengaluru and Delhi - learn more at kubecon.io
Don't miss KubeCon + CloudNativeCon 2020 events in Amsterdam March 30 - April 2, Shanghai July 28-30 and Boston November 17-20! Learn more at kubecon.io. The conference features presentations from developers and end users of Kubernetes, Prometheus, Envoy, and all of the other CNCF-hosted projects
Intro: CNCF Security SIG - Brandom Lum, IBM
CNCF Security SIG representing cross-cutting concerns including authentication, authorization, auditing, policy enforcement, privacy and compliance. The SAFE WG has transformed into CNCF SIG, and this presentation will share the history of the group, accomplishments, on-going efforts with time for participants to share solutions and challenges.
https://sched.co/PbI3
A
So
what
exactly
is
sick
security?
So
she
s,
gf6
security,
isn't
smooth
and
our
main
vision
really
is
to
follow
this.
We
increase
the
posture
of
security
across
colleges
in
general
and
I.
Think
that
we
are
hoping
to
be
able
to
do
is
be
able
to
make
it
so
that,
whenever
developer
and
operator
of
an
auditor
talks
about
creating
a
solid
native
application
of
solutions,
they
should
be
comfortable
with
knowing
fire
exactly
it's
a
security
risk.
While
the
steps
I
can
take
to
mitigate
certain
risk
within
my
security
solutions.
A
A
All
right,
okay,
the
second
thing
that
we're
doing
is:
we
want
to
be
able
to
have
a
comma
and
a
single
tool.
So
what
we
do
follow
up
on.
We
do
the
assessment.
Basically,
what
we
have
is
we
look
into
the
security
forces
projects
and
TNCs.
We
do
a
few
of
them
and
then
we
get
a
little
bit
about
you
know:
here's
the
trap
model
that
you
should
be
looking
at
when
you
look
at
using
this
product
or
using
this
program.
A
So
these
are
things
you
should
consider.
These
are
things
if
you
are,
if
you
need,
if
you're
using
this.
These
are
things
that
you
get
from
there
do
things
like
you,
don't
get
better,
I'll
go
into
more
detail
later
and
the
surface
area
for
the
zoo.
This
was
a
long
kind
of
audit
and
compliance,
and
we
often
get
this
issue
where
orders
come
to
us
and
say
that.
A
Hello,
this
is
Beth,
okay,
so
the
top
point
which
is
around
audit
right.
So
there
are
several
customers
that
come
to
us
and
oh
just
vendors
in
general,
and
they
say
that
auditors
that
look
at
cognitive
solutions
and
architecture
don't
really
know
how
to
assess
the
security
of
it.
This
is
something
that
is
very
new,
and
you
know,
auditors
still
have
some
trouble
and
you
know
understanding
how
the
risks
has
changed
when
you
do
something
like
a
CI
CD
process
with
containers.
A
What's
the
isolation
in
that
regard,
so
these
are
the
kind
of
the
focus
areas
of
the
group
a
little
bit
of
history.
So
this
the
same
working
group,
salad
in
December,
2017
from
casual
conversation
between
a
couple
folks-
and
we
started
the
initial
safe
working
group,
which
is
now
called
six
security,
and
we
started
with
this
idea
of
okay,
we're
gonna,
identify
all
the
different
personas
and
use
cases
and
cognitive,
interflow
security,
all
right.
So
we
we
continue
on
this.
A
We
much
of
the
policy
working
group
which
there's
gonna
be
a
top
beta
that
I
mentioned
so
where
this
is
they're.
Looking
at
kind
of
what
you
call
me,
the
policies
be:
what
about
the
policies
which
you
know
has
security
considerations?
How
does
50?
How
does
OPA?
How
do
these
projects
get
integrated
with
them
and
later
down
the
road?
A
Around
last
year
in
August
to
18,
we
read
a
PR
for
CN
CF
considerations
and
thanks
to
our
chairs
and
the
our
sponsors
at
the
TOC,
we
were
able
to
get
the
second
status
and
June
of
this
year.
So
we
are
a
fatty
music,
but
we
have
quite
a
good
amount
participation.
So,
right
now
we
have
45.
Members
is
kind
of
a
diverse
set
of
members.
We
have
people
from
cup
vendors,
we
have
security
providers,
you
have
end-users
financial
users
and
so
on
so
a
lot
of
representation.
A
A
So
I'm
going
to
talk
about
two
or
three
focus
areas
that
we've
been
putting
work
into
over
the
past
past
year,
so
one
of
it
is
landscape,
so
some
of
you
may
be
familiar
with
the
CNCs
landscape.
So
this,
if
you've
seen
this
like
big
picture,
with
a
ton
of
different
logos
on
the
same
page,
basically
classifying
okay,
why
this
is
cognitive
technology?
Where
should
it
be?
Is
it
orchestration
there's
a
runtime
whatever
all
right,
so
with
six
security?
A
We
want
to
do
a
similar
thing
for
security
right,
so
we
want
to
be
able
to
have
a
bit
more
fine-grained
control
of
all
classification
of
what
security
project
is
right.
Is
it
something
to
do
with
identity?
Is
it
something
to
do
with
privacy
and
once
you're
able
to
classify
all
the
projects
into
the
different
areas,
you
can
kind
of
see
the
gaps
and
see?
Oh,
this
is
where
mall
projects
you
should
be.
A
Oh,
this
is
somewhere
that
you
know
we
should
put
more
interest
in
another
thing
which
sets
us
apart
from
the
general
CNCs
landscape,
that
we're
trying
to
push
for
is
that
when
the
CNCs
landscape,
the
the
scope
of
it
really
is
targeted
at
the
cns
year
project
with
themselves,
but
with
security.
This
is
a
little
bit
different
because
a
lot
of
the
security
projects
that
I
use
in
production
on
solutions-
actually,
you
know,
go
generic
security
solution.
So,
like
key
management
systems
like
Paul,
you
know
anything
in
the
sequence
namespaces.
A
So
we
we
have
kind
of
a
drop
of
all
these
things
they're
moving
forward.
If
you
are
interested
in
how
think
of
anything
the
issues
I've
put
on
the
site.
So
if
you
don't
want
to
just
click
into
it,
you
can
kind
of
see
what
the
details
that
we
refer
to
each
one
about
and
also
you
can
contribute.
We
are
definitely
very
open
to
that.
A
A
So
the
idea
here
is
treating
one
is
we're
gonna,
look
at
cognitive
security
projects
or
projects
in
general
and
make
sure
they're
good
security
posture.
So
this
minute
we
ensure
that
you
know
you
have
a
proper
CI.
Do
you
do
scanning
after
images
and
so
on?
On
top
of
that,
we
ensure
that
all
the
projects
have
a
security
process.
So,
for
example,
do
they
have
a
process
for,
if
there's
a
vulnerability,
discovered
in
a
project?
Is
there
a
security
team
and
watch
there
at
once,
I'm
like
so
on
top
of
that?
A
So
we
salad
with
two
this
year
and
they're
almost
complete,
so
the
first
is
in
total
in
total
is
a
kind
of
signature
verification
mechanism
which
validates
certain
processes
within
the
container
supply
chain.
All
right
do
ensure
that
you
have
scanning.
You
have
your
signing
done.
Maybe
you
have
encryption
certain
compliance
steps
that
you
want
to
perform
OPA,
which
is
open
policy
agent.
Some
of
you
may
be
familiar,
may
thought
that
it's
basically
a
policy
language
and
a
policy
service
that
allows
you
to
and
Co
policies
and
make
decisions
of
them.
A
So
what
we
do
is
we
work
with
the
maintenance
and
the
security
team
of
the
individual
projects
and
we
come
what
what
ends
up
the
process
is
that
we
go
to.
Maybe
it's
usually
about
two
to
three
weeks.
The
main
aim
of
this
is
to
get
general
consensus
of
the
security
of
a
project
and
what
the
result
of
this
is.
Is
we
get
this
document
so
I'm
just
gonna
switch
here.
A
A
B
A
The
document
sets
are
really
generic
will
kind
of
Qualis
this
project.
What
is
it
trying
to
provide
in
terms
of
security
so
like
a
little
bit
of
background
and
stuff,
the
goals
that
are
trying
to
achieve
in
terms
of
security,
long
goals
and
so
on,
and
so
this
these
things
are
kind
of
very
straightforward.
You
can
find
out
in
the
repo,
but
what
I
think
is
really
interesting
for
general
users.
If
you
go
down
into
the
document,
what
we
do
is
we
ask.
We
perform
the
security
analysis,
so
basically
we're
trying
to
identify.
A
A
One
of
the
things
that
you
have
to
consider
who
are
the
mitigating
steps
you
can
take
from
there
onwards,
so
we
go
into
details
about
okay,
so
our
pod
attack
surfaces
were
the
things
that
the
project
would
do
better
in
the
short
term
in
the
long
term,
whether
it's
and
forcing
better
default,
whether
it's
you
know
providing
better
education,
the
users
that
this
is
not.
This
is
something
that
the
platform
provides
and
certain
things
you
should
not
assume.
A
So
this
talks
about
you
know
why,
if
you
have
a
key
compromise,
what
happens?
What's
the
implications
of
it,
and
another
thing
that
I
think
is
really
useful
here
is
for
certain
components,
so
certain
projects
rely
on
certain
other
components,
so,
in
the
case
of,
in
totally
relies
on
some
kind
of
storage,
verifiable
storage
for
the
signatures
that
creates
all
the
content,
blob
sector,
and
so
like
this
document,
talk
about.
Ok,
what
are
the
different
trade-offs?
A
Right,
so
we
have
a
couple
of
security
assessments
that
are
coming
out.
This
one
is
going
to
be
our
Falco.
One
was
going
to
be
on
key
cloak
and
possibly
haba.
So
these
are
the
two
projects
that
were
looking
at
if
you're
interested
in
participating
and
security
assessments
do
ping
us
on
sack,
give
us
a
shot
on
the
mailing
this
and
also
put
your
name
down
on
it.
The
issue.
A
So
another
thing
that's
been
going
on
is
a
policy
white
paper,
so
this
is
not
something
I'm
very
involved
with
so
I,
don't
know
it's
a
fungus
here,
he's
the
one
that's
really
driving
this.
He
followed
the
policy
workgroup
and
he's
gonna
have
a
deep
dive
about
the
coop
analysis
policy
workgroup,
you
know
I
hope,
I
think
he
may
talk
a
little
bit
about
this
white
paper
that
we're
writing.
A
All
right,
so
a
few
things
are
coming
out
is
one.
We
also
have
I
thought
those
policy
paper.
We
are
also
writing
a
more
generic
security
white
paper.
So
what
is
this
white
paper
it's
going
to
talk
about?
Is
you
know?
What
is?
How
do
you
do?
Security
in
college
that
you
know
it's
not
gonna,
be
something
specific
to
kubernetes
is
not
gonna,
be
something
specific
to
certain
runtimes.
Certain
products
is
really
you
know
from
auditor
perspective
or
from
a
security
perspective.
A
What
are
the
you
know
the
base
things
that
you
have
to
secure
quality,
a
need
that
you
need
some
kind
of
devops
pipeline,
some
kind
of
verification,
runtime
verification.
So
this
is
something
that
is
coming
out
in
something
that's
already
in
progress
like
I
say
the
policy
white
paper
is
also
ongoing.
A
Another
big
thing
that
we
have
is
a
six
security
microsite,
so
there's
been
a
lot
of
ideas
around
providing
education
about
security,
so
one
of
the
ones
of
the
one
of
the
things
that
we
talked
about
is
on
the
types
of
vulnerabilities
that
we
generally
see
in
cognitive
applications.
So
one
one
example
is
the
top
dollar
or
the
time
will
check
the
time
of
user
average
right
if
an
object
is
modified
in
between
where
the
the
value
we
can't
make
assumptions
about.
A
Generally,
we
see
quite
a
few
of
those
type
of
vulnerabilities,
so
the
Microsoft
on
the
self
a
few
purposes.
One
of
it
is
to
put
on
articles
that
share
about
you
know
here
are
the
types
of
attacks.
You
know
why
you
should
look
at
here's,
how
to
mitigate
mitigate
them
and
how
to
do
it
right.
We
also
hope
to
put
more
information
of
how
to
use
certain
security
tools
and
security
projects
and
just
security
posture
articles
in
general
and
last
but
not
least,
what
I
mentioned
before
we
have
in
total
open
we're
almost
done
Falco.
A
A
So
I'm
just
gonna
keep
it
short,
so
we
can
talk
there
after
this
all
you
have
any
questions
you
can
find
out
so
good
hub
everything
that
we
have
had
some
good
hub.
You
shouldn't
be
able
to
not
finding
any
information.
You
just
click
your
links
and
then
we
you
can
join
us
on
the
slack.
We
understand
CF
slack
now
with
the
six
security
channel.
A
Unfortunately,
we
so
we
meet
every
week,
but
we
also
understand
that
it's
really
difficult
to
find
a
time
for
everyone
to
meet
so,
unfortunately,
our
meeting
times
and
not
did
not
work
as
well
with
Europe
and
the
Asia
area.
But
what
usually
happens
is
the
meetings
and
all
compulsory
and
what
happens
is
like
if
you're
interested
in
security
assessment,
for
example,
then
you
know
we
will
form
a
small
group
or
three
to
four
people
and
they
they
find
a
good
time
to
meet
by
themselves.
A
So
if
you
look
at
the
github
and
then
the
notes
on
the
meetings
meetings
are
really
about,
you
know
what's
going
on
updates
from
different
people,
but
a
lot
of
work
in
the
group
actually
happens
offline.
All
right.
Thank
you.
So
much
for
coming
and
do
let
me
know
if
you
have
any
questions.
Thank
you.
B
And
I
had
many
conversation
with
ours.
Critic
active
in
our
company
and
I
can
fully
understand
the
security
people
always
like
the
policies,
the
rules
so
I'm
more
interesting.
You
know
on
the
how
piece
how
we
can
address
all
these
security
risks
and
wanna
bring
this
money.
You
just
hell's.
No,
don't
do
that
right.
So.
A
A
So
if
you,
if
you
look
into
the
issue,
we
have
a
security
overview
white
paper.
This
is
the
one
I'm
talking
about,
so
we
are
currently
in
progress
to
talk
about.
Okay,
the
other
things
that
you
have
this
appear
here
are
some
possible
ideas
or
projects.
You
can
look
at
it
so
yeah.
So
here's
here's
an
example
right.
Oh
this
is
again.
This
is
really
really
rough
draft.
This
is
something
that
we're
gonna
work
on
legs.
A
So
the
idea
is,
you
know,
compute
definition
and
security,
about
the
tools
and
resources
that
you
have
you
can
use
to
help
and
then
how
do
you
get
compliance
from
that?
You
know
how
do
you
do
runtime
for
anything
today?
So
I
think
these
are
some
of
the
questions
and
kind
of
you're
talking
about
that
may
be
useful
if
we
provide
some
some
insight
on
that
as
well
and,
of
course,
like
they're
things
are
network
file,
storage
and
stuff,
like
that,
so.
A
The
the
group
generally
has
quite
a
few
people
that
have
also
very
strong
opinions,
so
we
are
very
happy
to
hear
more
from
different
people.
I
think
it's
really
good.
If
we
have
a
discussion
on
you
know
what
are
some
perspectives
on
so
another
thing
is,
you
know
financial
users?
We
have
different
requirements
from
other
types
of
users,
so
you
know
one
of
the
things
to
consider.
Maybe
we
talk
about.
Oh
sure,
we
have
multiple
tiers
of
security
and
compliance
if
you're
a
regular
user.
A
If
your
team
or
your
architect
wants
to
talk
about
this
with
us,
you
know
every
perspective
of
pain
helps
yeah,
I,
hope
that
then
address
this
sorry,
oh
yeah,
so
what
I
would
recommend
doing
is
so
if
you,
if
you
just
like,
drop
a
good
and
go
to
github
issue
and
say
you're
interested
in
this,
and
then
this
group
will
follow
the
issues.
So
so
we
walk
very
ad
hoc.
So
we
will
follow
the
issue
and
also
so
this.
This
one
I
think
is
owned
by
Sarah,
who
is
one
of
our
chairs.