►
Description
Join us for Kubernetes Forums Seoul, Sydney, Bengaluru and Delhi - learn more at kubecon.io
Don't miss KubeCon + CloudNativeCon 2020 events in Amsterdam March 30 - April 2, Shanghai July 28-30 and Boston November 17-20! Learn more at kubecon.io. The conference features presentations from developers and end users of Kubernetes, Prometheus, Envoy, and all of the other CNCF-hosted projects
Intro: CNCF Security SIG – Sarah Allen & Jeyappragash Jeyakeerthi, Tetrate.io
CNCF Security SIG representing cross-cutting concerns including authentication, authorization, auditing, policy enforcement, privacy and compliance. The SAFE WG has transformed into CNCF SIG, and this presentation will share the history of the group, accomplishments, on-going efforts and plans for 2019.
https://sched.co/OB0K
A
This
is
Sarah
my
partner
in
crime
for
security,
working
group
and
I'm.
Jj
will
just
go
and
a
little
bit
about
the
history
and
the
overview
of
what,
where
we
started,
where
we
are
right
now
and
then
we'll
talk
a
little
bit
about
the
projects
that
we
are
working
on
currently
and
where
we
could
use
help.
A
A
Mean
security
is
something
that
nobody
really
cares
about
until
something
is
broken,
then
people
are
there.
Fixing
that.
Can
you
hear
me?
Okay,
like
I,
say
security
is
something
that
people
never
really
cared
about
until
something
is
broken
and
when
it's
broken,
then
they're
they're
fixing
so
you'll
never
find
many
people
here
in
the
working
room,
but
there
are
a
lot
of
people
that
are
subscribed
to
the
safe
working
group,
which
is
like
the
secrecy
and
security
sig
right
now,
so
we'll
generally
go
over
the
focus
area.
So
we
start
we
started.
A
A
That
has
been
noticed,
but
not
addressed.
Early
on
is
a
bunch
of
the
infrastructure
that
comes
up
comes
up
with
same
set
of
security
problems,
whether
it's
identity,
authorization,
auditing
or
assessment
of
risk.
Every
every
every
infrastructure
has
the
same
set
of
concerns
and
same
set
of
problems
in
similar
set
of
ways,
but
then
everybody
addresses
it
in
this
into
in
different
projects.
So
one.
A
A
A
A
So
we
we
hired
him
over
and
then
and
then
we
started
building
the
community
like
lot
of
people,
people
from
different
industries
in
different
different
projects,
some
related
to
cube
CNC
of
some,
not
like
cloud
foundry
Street
to
me,
the
she
participated
heavily
and
then
she
gave
a
lot
of
use
cases
that
we
could
possibly
leveraged
off
of
and
then
Google
of
course.
So
we
started
that
and
then
there
was
a
policy
working
group
which
had
like
somewhat
of
an
overlap
in
terms
of
what
we
were
doing
and
what
they
were
doing.
A
So
we
ended
up
collaborating
together,
which
is
a
which
is
a
big
thing
for
for
us
and
for
security
in
general,
I
mean
like
too
many
fragmented
efforts
is
not
going
to
go
anywhere
anyway
right.
So
that
was
that
was
one
thing
that
happened,
and
then
we
went
in
for
cnc
of
consideration
around
the
same
time
when
working
groups
where
there
was
debate
about
like
working
group
vs.
A
six
starting
to
happen
so
we
went
in
there,
then
we
became
like
the
examples
of
like
how
to
create
six
from
a
working
group
and
that
started
happening
from
2018.
Like
all
the
way
up
to
no
and
finally
like
we
had
renaming
of
safe
to
cnc
of
security,
sick
and
then
now
we
are
into
the
wave
you'd
have
to
yeah
there.
There
is
a
repo,
obviously
the
the
links
all
point
to
a
repo
that
you
can't
see
from
here.
A
C
C
I
started
doing
internet
software
in
the
mid-90s
and
the
fundamentals
are
the
same,
except
that
things
are
quite
different
and
kind
of
agreeing
on
that
common
vocabulary
is
very
challenging.
We
talk
about
identity,
I
was
really
in
this
50
project
and
then
I
realized.
Oh,
it's
only
solving
service
identity,
of
course,
I
do
a
lot
of
application,
development
and
user
identities
a
completely
different
thing.
You
know
and
a
lot
of
these
projects,
you'd
say
well,
does
your
project
do
this
and
the
answer
is
well,
it
could
do
that,
which
is
not
really
the
answer.
C
C
So
you
can
decide
whether
you
want
to
just
keep
an
eye
on
it
to
keep
up
to
date,
on,
what's
going
on
with
CN
CF
and
and
how
we're
we're
helping
to
articulate
solutions
and
cloud
native
security
or
whether
you
want
to
get
involved
and
help
us
solve
these
problems,
because
we're
very
much
as
JJ
said
at
the
beginning
of
explaining
these
things.
Each
of
us
has
a
lot
of
experience
and
solves
these
problems
independently
in
our
own
context.
C
But
one
of
the
special
things
about
this
group
is
that
it
includes
people
who
are
trying
to
figure
out
government
policy
or
figuring
out
really
novel
or
foundational
solutions
in
academia
that
we
can
then
apply
in
industry.
We
have
people
who
are
working
on
application,
development,
people
who
are
working
on
platforms-
and
you
know
all
the
different
parts
of
this
puzzle,
and
so
that's
one
of
the
exciting
things
is
that
together
we
can
build
a
picture
of
it
that
no
one
of
us
has
on
our
own.
So
the
landscape
is
a
big
challenge.
C
If
you
want
to
help
you
can
chime
in
on
issue
124,
and
we
are
then
our
next
step
is
to
really
figure
out
how
we
can
use
these
categories
to
make
it
so
that
we
can
help
people
navigate
this.
Both
the
security
solutions
and
the
security
features
of
projects
that
are
not
security
related
because,
as
you
all
may
know,
just
because
it's
not
a
security
project
or
maybe
because
it's
not
a
security
project.
C
So
security
assessments
has
been
something
that,
in
the
last
five
or
six
months,
a
number
of
us
in
the
group
have
also
been
very
active
in
we
put
together,
justin
Kappos
who's
in
the
audience,
put
together
the
initial
guidelines
and
which
were
quite
challenging
to
come
up
with
something
that
we
felt.
We
could
run
through
all
the
different
projects
and
have
a
process
that
could
be
replicated
by
a
large
security
team.
C
That
might
be
not
us
that
might
be
from
different
companies
from
different
parts
of
the
industry,
so
that
somebody
who
was
a
security
expert
who
understood
the
audit
process,
would
be
able
to
scrub
in
and
follow
a
process
and
that
it
would
make
sense
across
multiple
projects.
So
what
we
did
was
we
we,
we
volunteered
in
toto
in
Santiago,
Torres
arias
was
very
generous
with
his
time
in
going
through
this
process,
in
fact
multiple
times,
so
that
we
could
figure
out.
C
How
would
it
work
as
a
process,
and
we
came
up
with
I'll,
just
give
it
a
sort
of
sneak
peek
at
the
repo,
if
you
haven't
checked
it
out,
and
so
we
put
together
really
just
an
outline
of
what
we're
trying
to
achieve
here
and
the
first
is
really
reducing
risk
across
the
ecosystem.
Okay,
the
security
exists.
Assessments
are
happening
for
a
few
different
reasons.
One
reason
is
well
there's
a
product
who
wants
to
join
the
CN
CF
and
the
TOC
wants
to
be
able
to
say
so.
C
It's
up
for
this
project
that
says
it's
doing:
security
stuff
that
you
know
reasonable.
Take
a
quick
look
at
it
first,
and
we
could
just
do
that,
but
we
wanted
to
also
seat
this
in
some
of
the
motivations
of
the
wider
part,
love
many
of
the
members
of
our
group
that
are
excited
about
the
CN
CF,
but
more
excited
about
the
opportunity
that
the
CN
CF
presents
in
terms
of
aggregating
all
of
these
folks
working
on
cloud
things.
C
So
the
motivation
of
a
lot
of
the
people
in
the
group
is
we
want
to
be
using
cloud
native,
open
source
projects
and
not
have
that.
Keep
us
up
at
night
and
be
woken
up
in
the
middle
of
the
night,
with
a
pager
going
off,
because
bad
things
have
happened
and
risk
is
inevitable.
But
there
are
a
lot
of
things
that
we
can
collectively
do
to
reduce
that
risk,
and
so
these
security
assessments
are
envisioned
of
being
sort
of
two-sided.
C
One
is
the
the
review
team,
where
two
or
three
of
us
would
sort
of
ask
questions
of
the
project
and
model
the
threats
and
discuss
the
the
potential
malicious
attack
surface
and
the
project
itself.
We
hope
that
they
are
getting
value
out
of
it.
The
first
projects
that
are
going
through
this
are
projects
that
have
a
lot
of
security
experts
on
the
team.
So
it's
a
delightful
two-sided
thing
where
they're
helping
inform
the
process
as
well
as
going
through
the
process.
C
But
then
we
anticipate
that
this
will
be
used
to
go
through
projects
where
there
maybe
isn't
even
a
security
expert
on
the
team.
Maybe
the
project
maintainer,
the
lead
maintainer
is
going
to
act
as
the
security
expert
they've
done
the
best
they
can,
but
there
may
be
some
things
that
they've
missed,
and
this
can
be
an
education
for
projects
that
have
less
security.
C
Focus
can
potentially
highlight
a
need
to
companies
that
are
using
a
project
and
might
not
be
aware
that
there's
a
need
for
more
staffing,
around
security
or
more
attention
or
better
communication
mechanisms
and
things
around
the
projects
that
aren't
purely
the
execution
of
effective
code,
because
the
engineers
on
the
projects
are
generally
pretty
good.
You
know,
with
some
exceptions
on
the
code,
rigour
at
least
they
have
a
list
that
they
know
they
need
to
attack
or
if
you
give
them
a
list
of
coding
things
back
tractable.
C
Some
of
the
things
that
I
think
the
CNC
F
offer
is
this,
this
opportunity
for
us
as
an
ecosystem.
Each
of
us
to
know
where
we're
going
to
put
our
energies
and,
as
somebody
who's
led
a
lot
of
projects
myself.
They
have
open
source
dependencies.
I
want
to
know
when
I
adopt
a
project.
Is
this
a
project?
C
C
Once
we
get
this
with
the
security
assessment
process
underway,
we
want
to
shift
our
focus
taking
some
of
the
learnings
and
the
in-progress
work
around
the
landscape
to
put
together
a
security
overview
white
paper.
What
we've
seen
is
that,
as
I
was
talking
about
there's
a
lot
of
people
who
have
different
ways
of
describing
the
same
things
and
that's
causing
slowdowns
in
adoption
of
cloud
native
technologies
and
there's
a
huge
number
of
companies
where
they
have
security
experts
who
are
new
to
cloud
and
they
need
a
guide
of
like
hey.
C
Feel
like
I'm
in
an
airplane,
so
so
the
point
is:
is
that
there's
a
number
of
things
that
policies
control
that
will
affect
the
integrity
of
your
system?
You
don't
think
of
many
people,
don't
think
of
quota
right
as
affecting
security,
but
you
don't
have
quotas,
then
somebody
can
really
attack
your
system
just
by
blowing
up
your
resource
usage.
So
policies
are
really
important
concern
for
this
group
and
then
we
have
a
goal
of
completing
five
security
assessments
this
year
and
so
we're
in
the
midst
of
two.
C
We
have
two
queued
up
and
then
TBD
we'd
like
to
find
a
something
so
I
identify
a
project
that
is
not
for
security
but
needs
security
and
Justin
and
Justin
will
talk
more
about
that.
So
so
these
are
two
places.
You
can
learn
more
there's
going
to
be
a
deep
dive
with
Justin,
Kappas
and
Howard
Wong
tomorrow
at
11
a.m.
and
then
at
2:00,
a
deep
dive
into
the
project,
security
reviews
and
so
I
want
to
open
this
up
for
questions.
D
D
C
For
bringing
that
up,
so
the
question
is:
there's
third
party
security
audits
that
the
CNC
F
does,
and
so
the
idea
that
this
security
assessment
would
typically
take
place
before
the
security
audit.
So
this,
like
a
sandbox
project,
a
project
which
doesn't
quite
have
its
security
act
together
or
ones
that
are
just
newer
to
CN,
CF
and
then
as
a
and
then
Justin
seems
like
he's
going
to
have
an
answer
to
this.
B
Yeah
I
just
want
to
point
out
one
thing,
which
is
that
what
we're
doing
isn't
a
security
audit
we're
not
going
line
by
line
through
the
code
looking
for
buffer
overflows
when
we
do
this,
this
is
a
process
that,
from
the
standpoint
of
somebody,
who's
participating
in
it,
you're
you're,
taking
a
few
days
to
a
week
of
your
time
to
do
it
and
you're
really
trying
to
understand.
Are
they
solving
a
real
problem?
Do
they
have
a
reasonable
approach?
Are
they
doing
things
like
you
know?
Is
there
risk
in
their
codebase
in
that?
B
E
C
So
the
question
is
people
get
involved,
so
this
URL
will
tell
you
how
there's
in
the
readme
there
is
a
mailing
list
and
the
channel
on
the
CNCs
slack,
and
so
you
can
just
chime
in
and
if
you
want
to
join
the
security
review
team.
Just
shout
out
on
slack
on
the
mailing
list
and
Justin
or
one
of
our
little
core
security
review
team
will
eagerly
shout
out
to
you
and
the
weekly
meetings
on
Wednesdays.
At
what
time
and
this
time
zone
1:00
p.m.
Eastern.
C
C
C
Okay
who,
in
your
room,
does
security
stuff
as
part
of
your
work?
Okay,
that's
probably
like
two-thirds
of
the
audience
I
think
it's
all
good.
That
many
of
us
are
cautious
about
considering
ourselves
security
experts
and
then
of
other
folks
in
the
room
who
is
leading
a
company
and
needs
to
worry
about
security,
less
of
those
leading
a
product
whew
all
right.
So
who
is
using
kubernetes
in
production?
C
E
C
A
great
question
about
the
sometimes
responses
to
security
concerns
are
not
certainly
not
in
a
regular.
You
never
know
what
you're
going
to
get
with
your
open
source
project
right.
You
have
to
look
at
the
specific
open
source
project
and
that's
actually
something
that's
come
up
in
the
reviews
is
how
much
are
we
in
the
assessment
go
to
worry
about
things
like
that,
and
so
we,
we
actually
sort
of
created
a
category
for
to
make
sure
that
that's
explained
and
identified
that.
C
Well,
maybe
the
guidelines
need
to
be
improved
a
bit,
and
maybe
we
can
do
a
better
job
of
giving
projects
advice,
and
so
that's
one
of
the
things
that's
really
coming
out
of
these
security
assessments
is
areas
where
you
know
we
all
kind
of
chime
in
and
say.
Well,
you
should
be
doing
this
and
you
should
be
doing
that
and
then
we're
like.
Oh
yeah,
that's
a
good
idea.
C
Maybe
we
should
write
that
down
to
all
the
other
projects,
so
we
we
we
aspire
to
have
those
guidelines,
some
of
them,
like
the
CII
best
practices,
touches
on
a
lot
of
these
things,
but
there's
a
lot
that
is
uncovered
is
not
covered
yet
so
so
definitely
I
think
something
that
we
would
like
to
be
able
to
produce
in
the
next
year
or
so.
The.
A
The
general
idea
is
to
centralize
all
the
knowledge
that
you
have
and
be
a
little
bit
more
prescriptive
about
like
what
what
should
be
done,
what
what
can
be
done,
but
not
necessarily
being
a
service
certifying
things
that
you
can
or
cannot
use
right.
So
there's
a
two
different
thing.
Then
there
is
a
enough
amount
of
knowledge
and
information
that
we
can
actually
gather
to
be
more
prescriptive
about
things.
A
That'll
itself
help
you
know
getting
a
secure
system
in
your
production,
but
other
part
of
like
being
being
a
certifying
body
or
something
equivalent
to
like,
say
like
what
Justin
was
saying.
We
can
audit
your
entire
code
base
to
say
that
this
is
clear
of
all
the
vulnerabilities
that
we
know
of
is
not
something
that
we
are
signing
up
to
do.
Yeah.
C
E
Oh
yeah
I
was
just
saying:
can
we
stand
the
lies?
Can
we
recommend
the
standardized
reporting
infrastructure
and
try
and
ensure
that
those
reports
to
actually
go
to
the
right
people
because
project,
maintainers
change
and
people
may
or
may
not
follow
the
issue?
Chucko
issue
tracker
may
move
and
someone
puts
it
in
the
elevation
tracker.
E
So
if
there's
a
guideline
for
a
supposed
to
centralized
reporting
infrastructure
but
equally,
as
importantly,
helping
maintain
this
understand
how
to
deal
with
a
report
in
a
responsible
manner
that
could
be-
and
once
again
you
know,
I'm
assessing
the
entire
open-source
community.
I
don't
have
a
lot
of
CN
CF
experience,
but
that's
something
I
see
I've
seen
as
a
gap
in
yeah.
C
C
C
D
Question
which
is
read
so
some
projects
from
CN
CF
when
they
go
up
through
the
ranks,
they
may
consider
some
security
parameters,
not
their
issue.
So
as
an
example,
they
may
say,
authentication
is
not
our
problem.
Is
there
a
plan
to
have
security
sort
of
try
and
guide
them
in
the
right
direction
of?
Perhaps
you
should
consider
education
as
part
of
your
problem,
so.
C
That
is
a
great
question
that
is
under
hot
discussion
amongst
our
group
members.
So
the
question
was
really
that
a
project
might
say
well,
Security's,
not
our
concern.
Authentication
is
not
our
problem.
These
are
stuff
and
it's
up
to
you,
and
so
there
are
some
people
in
the
group
who
think
that's,
nutty
and
other
people
in
the
group
think
well
under
a
certain
condition.
Maybe
that's
reasonable.
C
However,
what
you
know
like,
what's
probably
not
reasonable,
is
for
users
not
to
know
that
that
is
the
case,
and
so
that's
one
of
the
things
that
we
are
talking
about.
We,
you
know
we're
actually
going
to
schedule
a
working
group
meeting
to
talk
about
how
we
handle
that,
because,
with
the
security
assessments
right
now,
they've
been
very
friendly,
we've
been
anything,
that's
we've
brought
up,
we've
come
up
with
a
way
to
handle
it,
but
what
if
we
did
a
security
assessment
and
the
project
was
discreet?
C
What
if
the
security
reviewers
discreet
amongst
themselves,
so
we
want
to
talk
through
some
example
cases
of
well
what,
if
right,
what
if
we
were
assessing
a
project
and
they
held
an
opinion.
It
was
different
from
the
reviewers
right
we're
not
going
to
be
arbiters
of
that.
We
don't
have
to
be
right.
What
we're
we
have
the
opportunity
to
do
is
bubble
it
up
to
the
TOC.
C
The
technical
Oversight
Committee
in
the
the
CN
CF
in
a
digestible
way,
make
it
clear
what's
going
on
and
then
you
know
other
folks
can
decide
what
to
do
with
that.
But
this
is
a
great
and
interesting
question
come
to
our
working
group
meetings.
We
will
discuss
it
and
figure
it
out
together.
All
right,
I
think
that
we
are
out
of
time.
So
if
you
had
other
questions
or
if
you
want
to
talk
about
getting
involved,
come
to
one
of
these
other
sessions
and
we'll
also
hang
out
a
little
while
more
today
thanks
everyone.