►
From YouTube: Staring Into the Abyss with the Security Technical Advisory Group - Andres Vega & Brandon Lum
Description
Don’t miss out! Join us at our upcoming hybrid event: KubeCon + CloudNativeCon North America 2022 from October 24-28 in Detroit (and online!). Learn more at https://kubecon.io. The conference features presentations from developers and end users of Kubernetes, Prometheus, Envoy, and all of the other CNCF-hosted projects.
Staring Into the Abyss with the Security Technical Advisory Group - Andres Vega, VMware & Brandon Lum, Google
The CNCF Security Technical Advisory Group provides analysis and helps guide the community at large on the most appropriate security mechanisms, architectures, design patterns, and tooling. This presentation covers an introduction to the Security TAG, their charter and scope, and highlights on several efforts the TAG has undertaken (completed and in progress) with their community impact such as the Security Reviews, Supply Chain Security Paper, Security Pals, and so much more. This session is for anyone interested in cloud native security, and wishes to understand how to get involved.
A
Hi
everyone
thanks
for
coming
today,
I'm
going
to
share
with
you
a
little
bit
more
about
tag
security.
What
we're
doing
you
know
the
different
efforts
that
we
have,
what
we've
been
working
on,
all
the
cool
stuff
that
we
have,
and
you
know
I'm
going
to
talk
a
little
bit
more
about
how
we
can
get
involved.
You
know
what
are
some
of
the
security
challenges
that
we're
facing
today
as
a
community
and
as
at
larger
industry,
my
name
is
brandon.
I
am
a
co-chair
for
tech
security.
A
My
co-speaker
andreas,
unfortunately
on
something
came
up
and
he
can't
be
here
today,
so
I'm
gonna
go
quickly
through
the
slides.
Since
this
is
a
smaller
group,
I
kind
of
want
to
try
and
do
a
little
bit
more
engagement.
So
if
you
you
know,
you
want
to
ask
questions,
focus
down
on
specific
areas.
We
can
do
that.
A
So
just
typically,
you
know
who
what
when,
where?
Why
kind
of
things
so
I'm
going
to
start
with
who
are
we?
We
are
the
technical
advisory
group
for
for
the
cncftoc
for
security,
and
our
task
here
is
really
to
you
know
to
aid
the
toc
in
terms
of,
like
you
know,
helping
strengthen
the
security
posture
of
cncf
projects.
A
A
A
So
the
group
generally
works
on
github
there's
a
github
thing
that
we
are
made
out
of
professionals
enthusiasts
people
in
the
community.
We,
like
the
fresh
perspective
that
everyone
brings
to
the
table,
so
this
is
our
leadership
team.
So
if
you
see
anyone
or
fellow
community
members,
say
hi
myself
there
with
my
fellow
co-chairs
andrew
martin
and
aragna,
we
have
tech,
leads
andrus,
ash
and
pushka,
and
we
have
our
newly
nominated
tech
leads,
michael
lieberman,
marina,
mall
and
ragashree.
A
A
A
What
can
we
do
to
kind
of
like
push
the
boundary
of
security
for
organizations,
and
that
is
creating
a
breaking
and
another
aspect
of
that
is
also,
you
know
things
we've
done
in
the
white
paper,
so
we
we
just
launched
earlier
this
week,
the
v2
white
paper,
supply
chain,
security,
factory
reference
architecture
and
a
bunch
of
all
these,
so
I'm
going
to
just
dive
deeper
into
a
couple
of
these.
If
you
have
questions,
we
can
talk
about
it
later.
A
A
It's
a
revision,
two
of
the
original
white
paper
that
we
launched,
I
think
about
two
years
ago
now,
and
what
we've
done
is
we've
really
updated
it
with
some
of
the
newer
topics.
We
also
added
some
interesting
ideas
in
which
people
were.
You
know
struggling
to
understand.
Some
of
the
concepts
we
provided
a
framework
to
them
so,
for
example,
one
of
the
things
that
was
added
to
this
paper
is
the
mapping
to
ssdf.
A
So
if
you've
heard
of
the
the
nis
soft
secure
software
development
framework,
that
was
a
document
that
was
written
by
nis,
partially
to
kind
of
provide
some
guidance
in
terms
of
in
the
us.
We
have
the
executive
order
on
security
and
the
ssdf
is
there
to
kind
of
fulfill,
like
some
guidance
in
the
area.
A
A
You
know
you
talk
about
what's
random,
where
we
talk
about
ransom
cloud,
you
know:
how
do
you
protect
yourself
against
ransomware,
and
also
we
have
a
new
section
on
eu
compliance,
so
a
lot
of
cool
things
in
the
new
v205
paper
check
it
out
as
usual.
These
things
are
living
documents.
So
if
you
read
the
paper-
and
you
see
something-
that's
not
in
there
something
that
you're
really
really
interested,
it's
like
okay,
we
need
to
cover-
I
don't
know
like
micro,
vms
or
something
like
that.
A
You
know
we
need
to
cover
confidential
computing
deeper.
We
can
add
it
to
the
white
paper.
Whenever
we
get
kind
of
like
a
backlog
of
topics
that
we
see
come
up,
we
then
decide.
Okay,
you
know.
Here's
now
is
the
time
to
do.
V3,
sb2
launchers.
Also,
a
couple
of
cool
things
that
have
happened
is
we
have
now
audiobook
version
available
of
the
v1.
A
We
also
translations
of
the
original
white
paper
in
both
simplified
chinese
and
brazilian
portuguese,
and
these
are
kind
of
important
pieces
of
work
that
the
community
has
done,
because
you
know,
for
example,
in
in
portugal,
you
can't
use
the
document
unless
it's
written
in
portuguese.
So
that's
why
we
had
my
membership
community
to
translation.
A
A
We
are
still
looking
for
more
contributors
there,
so
if
you're
interested
in
kind
of
helping
to
translate
the
white
paper,
you
know
all
the
issue
numbers
on
the
site.
So
just
click
in
put
your
notes
as
say
that
you
wanna
you
wanna
help
out
another
thing
that
we've
been
dealing
a
lot
with
is
supply
chain
security
right.
So
back
a
couple
of
like
a
year
a
year
and
a
half
ago,
we
first
published
the
best
practices
white
paper
which
talks
about
okay.
A
A
So
the
second
step
of
this
is
that
we
were
working
now
in
progress.
It's
actually
done,
so
I'm
going
to
show
you
what
we
have
is
the
secure
software
reference
architecture
paper.
So
this
was
just
launched
30
minutes
ago,
so
so
yeah
we
we.
We
had
a
lot
of
things
churning
in
the
prep
line,
so
it
was
a
it's
going
to
it's
a
very
eventful
week.
A
A
Oh,
this
is
what
technology
you
should
use
and
blah
blah
blah,
because
you
know
these
things
are
going
to
change.
So
the
idea
is
we
provided
a
framework.
We've
provided
the
language
so
that
people
can
communicate
with
each
other,
so
that
people
can,
you
know,
reason
about
what
exactly
is
this
project
doing
right,
because
a
lot
of
people
have
projects
that
say
I
solve
supply
chain
security
right,
but
it's
essentially
they
are
solving
part
of
supply
chain
security.
So
it
provides
a
way
to
communicate
about
that.
A
We
have
a
couple
of
authors
coopers
here
in
the
room
contributors.
So
if
you're
gonna
be
sticking
around,
we
can
chat
to
that.
As
a
side
note,
there
is
a
project
that
was
built
with
the
reference
architecture
in
mind,
called
ssf,
which
will
be
renamed
to
fresca,
but
so
I
haven't
linked
here.
This
is
actual
code
implementation
using
different
different
projects
which,
by
the
open
ssf,
but
all
the
concepts
are
all
tied
from
the
secure
software
factory
paper.
A
Another
quick
thing
to
mention:
we
have
in
this
controls
mapping.
This
was
phase
one
that's
not
completed,
and
it
was
launched
earlier
this
week
as
well,
basically
maps
everything
in
the
white
paper
to
do
this
control.
So,
if
you're
looking
to
target
certain
this
controls
in
your
products
or
implementation,
you
can
kind
of
look
at
this
and
say:
okay.
This
is
how
I
can
do
it.
A
We
do
have
a
phase.
2,
that's
coming
up,
and
you
know
part
of
being
cloud
native
and
cloud.
New
security
is
that
we
want
to
have
automation
right.
We
we've
understood
that
we
can't
do
security
manually,
and
so
the
next
step
of
this
is
to
create
continuous
compliance,
and
so
one
thing
that
we're
looking
at
is
oscar
and
the
way
we
get
there
is
to
first
figure
out.
You
know
what
the
evidence
that
we
have
together.
A
A
A
A
So
we
we
engage
with
other
communities
within
the
cncf
as
well
as
outside
the
cncf.
So
we
we
talked
to
the
kubernetes
policy
working
group
groups,
security.
We
have
a
cross
members.
One
of
our
tl's
pushka
is
a
member
for
both
cloud
security
alliance.
We
talk
to
them
pretty
often
as
well
as
open,
ssf
salsa.
As
a
regards
to
you
know
the
supply
chain
and
reference
architecture.
A
Another
thing
we
do
is
we
interact
with
other
cncf
projects.
So
if
you
are
a
cncf
project
and
you're
thinking,
okay,
I
need
to
do
security
like
I'm.
I
have
a
security
project
and
I
kind
of
want
to
kind
of
reach
into
the
community
find
end
users
get
some
feedback
on.
What
should
I
do?
How
should
I
make
security
better?
A
A
What
are
the
security
considerations
I
have
to
think
about,
and
we
have
self-assessment
and
joint
reviews
which
are
a
analysis
of
the
security
parts
of
the
project,
so
this
usually
comes
in
the
project
pipeline.
Although
we
encourage
projects
to
just
come
up
and
do
it,
you
get
a
very,
very
well
well
fleshed
out
document
and
a
bit
that
says
if
you're
interested
in
using
this
project-
and
you
want
you're
thinking
about
security.
This
is
all
you
have
to
know
trent
model.
What
are
the
considerations?
A
A
Okay,
so
this
was
just
what
I
talked
about.
We
have
two
items,
two
projects
that
are
coming
up
for
this:
we're
looking
for
a
security
power
for
flux,
multi-tenancy,
so
for
those
that
are
not
familiar,
flux
is
a
multi-multi-tenant
kubernetes,
multi-cluster
deployment
system,
and
so
so
one
of
the
things
they're
doing
in
graduation
is
they
have
this
new
multi-tenancy
proposal
and
part
of
that
is.
We
want
to
be
able
to
make
sure
that
it's
good,
so
we
we're
looking
for
security
power
for
that.
A
So
another
thing
that
the
group
of
us
working
on
is
an
event
called
global
security
vulnerability
summit,
I'm
pitching
an
event
for
another
another
conference.
This
is
gonna,
be
in
in
june
next
month
in
austin,
together
with
the
open
source
security
summit,
and
you
know
what
we
are
thinking
about
here.
Is
you
know
how
do
we
solve?
We
always
talk
about
dog
for
jay
drachel.
A
A
We
see
efforts
like
osb
coming
out,
so
this
event
hopes
to
gather
the
community
together.
Talk
about
it.
You
know
we
have
governments
involved,
assets,
involved
and
vulnerability,
databases
involved,
so
that's
a
that's
going
to
be
a
good
forum
and
also
you
know
we're
looking
to
future
topics
like
how
do
you
do
analysis
now
like
assuming
that
I
have
the
graph
all
together
right
of
all
the
information?
A
Two
efforts
that
are
currently
going
on
with
supply
chain
security
now
post-reference
architecture.
The
first
is,
you
know.
Obviously
s-bombs
is
a
it's
a
very
hot
topic
now,
but
there's
there's
some
gaps
in
terms
of
like
what
does
s
ball
mean
in
certain
contexts
right
when
you
have
a
piece
of
your
package
or
you
have
a
software,
you
know,
s1
is
pretty
well
defined,
right,
you're,
defining
what's
in
that
package
or
what's
in
that
binary.
A
But
when
you
talk
about
cloud
native,
when
you
talk
about
microservices,
you
talk
about
software
as
a
service
infrastructure
as
a
service.
What
does
it
mean
to
have
a
s-bomb
right
if
I'm
hosting
a
service
on
you
know?
As
software
as
a
service
is
my
sbom,
the
python
code
that
runs
on
it?
Is
it
the
container
that
it
runs
in?
A
Is
it
the
vm
that
it's
running
in
the
kubernetes
cluster
that
it's
running
in
bare
metal
machine
is
running,
and
so,
as
you
can
see,
kind
of
like
there
is
that
there
is
a
kind
of
open
questions
where,
where
we
as
a
community,
we
have
to
come
together
and
provide
some
guidance
for
this
right.
I
think
there's
going
to
be
trade
dollars,
it's
probably
going
to
be.
You
know
your
practical
guidance
that
we
can
provide
there.
A
Another
part
of
this
is
you
know
the
s1
community
and
supply
chain.
Community
kind
of
have
been
going
on
in
their
own
in
their
own
tracks,
and
we
want
to
tie
a
lot
of
this
together
because
generational
s-bombs
and
the
use
of
s-bombs
right.
We
talk
about
generational,
s-bombs
and
great.
We
have
them,
but
do
I
know
they're
from
the
correct
place
or
they'll
generate
it
accurately
or
you
know
it's
can.
I
trust
this
s-bomb
and
it's
the
same
with.
Can
I
trust
this
binary?
A
So
that's
why
we
see
like
a
lot
of
overlaps
with
the
supply
chain
practices
and
that's
where
you
see
kind
of
cross-pollination.
There
also
there's
a
lot
of
big
open
questions
in
the
industry,
like
distribution
and
s-bonds,
which
have
not
really
been
talked
that
much
about
another
thing
that
we're
looking
to
do
is
to
apply
the
the
best
practices
and
the
reference
architecture
to
cnci
projects
right.
A
So
the
idea
that
is
to
to
run
an
instance
of
the
reference
architecture,
that's
the
project
for
openssf
and
now
you
know,
pick
a
few
cncr
projects
and
say:
okay,
we're
going
to
try
and
bootstrap
you
into
this
we're
going
to
say:
okay,
let's
you
know
we're
going
to
figure
out
how
this
works,
how
we
can
get
that-
and
you
know
hopefully
based
on
those
proof
of
concepts,
try
and
scale
up
and
kind
of
you
know
make
this
a
thing
that
cncf
can
do.
You
know
where
you
talk
about.
A
We
need
to
put
money
into
security
and
open
source
security,
but
like
no
one
knows
how
to
use
the
money
or
we
don't
know
how
to
efficiently
do
it.
So
that's
the
idea-
and
I
think
hopefully
also
can
influence
the
open,
ssf
alpha
mega
project
where
we
say:
okay,
look:
we've
provided
some
ideas
that
we
have
been
able
to
execute
in
the
openness
in
the
cncf
context.
A
A
Everything
is
issues
anything
that
we
talk
about
goes
into
issues
we
do
meet
every
week
on
wednesday
right
now.
It's
10
a.m.
Utc!
My
seven,
I
think
that's
probably
about
7
pm
this
time,
but
I
think
what
we
are
we
are
thinking
about.
Doing
as
well
is
we're
thinking
about
starting
up
at
eu
eu
meeting,
so
we
may
kind
of
bounce
between
those
two.
If
you're
interested
in
hosting
one
of
these
tech
meetings,
please
do
contact
us
as
well
we're
looking
for
people
that
really
you
know
you.
A
D
So
I
saw
a
presentation
yesterday
talking
about
the
different
types
of
s-bombs
and
maybe
some
relational
links
between
them
and
how
they
could
come
with
packages
of
evidence
and
other
things.
So
I
noticed
you
had
a
line
that
says,
give
guidance
on
how
people
should
be
using
consuming
these
s
bombs,
because
we
don't
want
to
just
generate
them
and
have
people
go
thanks
and
check
a
box
right.
Yes,
they
should
be
machine,
readable
and
other
things.
So
any
any
efforts
along
those
lines
that
you're
working
on.
A
So,
from
the
perspective
of
the
cncf,
we
are
trying
to
start
that
up.
There
are
other
efforts
that
are
going
around
in
the
community,
so
there
is
the
s-bond
coalition,
which
is
part
of
the
cyber
security
group.
That's
providing
some
guidance.
We
are
going
to
have
a
workshop,
so
we
have
at
the
risk
of
self-promoting.
A
A
A
You
know:
implementation
of
sponsored
ecosystem
as
well,
as
you
know,
lack
of
clarity
of
what
exponents
mean
and
you
know,
spx.
For
example,
we
have
a
so
within
the
space
community.
We
have
a
build
profile
group.
We
have
a
defense
group,
so
we're
looking
at
kind
of
like
these
different
pockets
of
of
of
documents
and
how
they
link
together.
But
I
think
eventually,
what
we're
seeing
in
spdx
3.0
is
like
how
to
bring
all
these
things
together.
A
A
That's
really,
you
know
how
do
I
take
s-bomb
plus
cb
data
plus
back
data
equals
policy
engine
and
action,
so
they're
looking
at
the
action
part
of
it
right
so
vex
talked
about
affected,
not
affected,
not
affected
means
zero,
nothing
to
do
and
if
you're
affected,
they
provide
guidance
on
like
what
you
have
to
do,
or
how
are
you
affected
so
that
that
really
ties
in
to
your
consumption
question
right?
How
do
we
eventually
get
get
to
how?
How
do
we
take
action
on
these
things?.
B
A
A
A
A
I
think
the
the
isolation
use
cases
we're
also
looking
at
in
supply
chain.
So
this
is
something
that
we
talked
about
in
the
supply
chain
reference
architecture
paper,
but
we
didn't
include
that
much
in
this
one,
because
the
technology
wasn't
really
there
yet.
So
we
couldn't
really
talk
about
it.
That
much
so
I
think
that
there
are
valid
use
cases.
I
think
it'll
be
it'll,
be
nice.
I
know
this.
You
all
have
done
a
lot
of
great
work.
A
B
E
Hi
brenton,
okay,
question:
for
my
side,
it's
also
built
in
the
contrast
of
confidential
containers.
Do
you
have
ideas,
use
cases
to
use
hsms,
okay
for
security
modules,
specifically
local
hardware,
security
modules
at
scale
to
improve
security
on
key
management
or
go
go
even
into,
and
let
me
say,
secure
keys
and
rep
keys.
A
Yeah,
I
think
we
do
talk
about
hsms
in
the
cloud
native
security
part
paper.
I
don't
think
we
dive
deep
into
the
different
deployment
models
of
hsm,
although
I
think
that's
interesting
right
because
essentially
you're
creating
your
track
model
based
on
the
the
the
authorization
of
the
key
and
who
has
access
to
it
right.
So
I
think
that'll
be
interesting.
There'll
be
interesting
thing
to
discuss
and
you
know
I
think
we
can
add.
We
can
add
more
guidance
and
I
don't
know
whether
there
would
be.
A
A
There
is
also
like,
especially
in
open
source.
You
learn
a
lot
about
how
open
source
ecosystems
work
like.
How
do
you
get
contributors?
How
do
you
keep
contributors?
What
are
the
factors
that
matters
and
kind
of
like
for
me?
It's
benefited
me
in
a
way
that,
like
the
way
I
operate
in
open
source
is
a
lot
more
more
intentional,
but
I
understand
okay,
you
know
these.
These
are
what
matters
in
open
source
community.
This
is
how
we
get
there
here.
A
F
A
It
is
exactly
the
point
like
finding
people
to
assess
with
the
security
reviews
is
something
that
something
that
has
been
difficult
right.
We
we
already
have
tried
to
scale
down
like
we
noticed
that,
like
you
know,
people
that
come
into
open
source
that
want
to
work
on
a
specific
project
attention
span
is
like
three
to
four
weeks,
so
we've
scaled
down
like
the
the
review
to
two
weeks.
A
You
know
it's
really
bite
size,
it's
really
simple
and
we
are
looking
for
for
for
people,
and
you
know
whether
your
super
deep,
you
know
a
security
review
can
be
going
deep
into
okay.
Let's
take
a
look
at
you
know
what
passes
they're
using
to
to
kind
of.
Let's
look
at
how
they're
handling
security
events.
How
did
you
know?
Do
they
have
a
cdcic
pipeline?
A
You
know
what
other
are
they
generating
their
s
bombs
and
things
like
that,
and
so
it
I
think
it's
a
good
gateway
project,
the
getting
involved
in
the
tech.
I
know
that
was
the
first
project
I
worked
on.
This
was
initially
we
were
setting
up
this
reviews
for
like
in
total,
and
things
like
that.
I
would
encourage
everyone,
you
know
it's
a
very
low,
low
commitment
way
to
like
get
into
the
tag.
You
know
learn
about
a
new
project,
they're
interested
in,
and
that's
what
that's
what
I
did
right.
A
I
I
needed
to
work
on.
I
needed
what
conspired
for
one
of
my
work
projects,
so
I
was
like
all
right
I'll.
Do
this
fire
review
and
that
way
you
get.
You
know
you
learn
about
the
project
you
get
direct
access
to
maintainers
and
then
you
make
friends
with
them
right.
You
create
the
connections
there
so
yeah.
I
would
encourage
everyone
to
do
that.