►
Description
Join us for Kubernetes Forums Seoul, Sydney, Bengaluru and Delhi - learn more at kubecon.io
Don't miss KubeCon + CloudNativeCon 2020 events in Amsterdam March 30 - April 2, Shanghai July 28-30 and Boston November 17-20! Learn more at kubecon.io. The conference features presentations from developers and end users of Kubernetes, Prometheus, Envoy, and all of the other CNCF-hosted projects
CNCF SIG-Security Intro - Sarah Allen, CNCF SIG-Security & Brandon Lum, IBM
Cloud Native” is open source cloud computing for applications — a complete trusted toolkit for modern architectures (CNCF presentation). There are multiple proposed projects which address key parts of the problem of providing access controls and addressing safety concerns. Each of these adds value, yet for these technical solutions to be capable of working well together and manageable to operate they will need a minimal shared context of what defines a secure system architecture.
https://sched.co/Uahe
A
Jjb
on
Twitter
and
we're
gonna
tell
you
a
little
bit
about
the
group
and
what
we're
doing
and
invite
you
to
get
involved.
So
I
have
a
short
presentation
and
then
reserve
some
time
at
the
end
for
discussion
questions.
So
we
can
all
talk
about
whatever
you're
interested
in
so
just
going
over,
who
we
are,
what
we're
doing
and
how
to
get
involved.
So
our
mission
is
really
about
reducing
risk
to
the
whole
ecosystem.
A
A
We
have
a
pretty
broad
Charter
and
what
we've
been
doing
or
a
relatively
young
group
is
focus
on
the
common
understanding.
How
can
we
all
be
speaking
the
same
languages?
There's
not
human
spoken
language,
but
actually
definition
of
terms,
and
you
know
when
we
say
you
know
we
have
offend
thee
and
all
of
these
different
things
where
we
come.
We
have
a
broad
set
of
security
experts.
A
We
have
huge
membership
for
a
group.
That's
only
been
around
informally
as
the
safe
working
group
since
mid
2018
and
as
a
CN
CF
sig
just
less
than
a
year,
so
just
to
kind
of
give
you
a
sense
of
where
we're
at
we
started
as
secure
access
for
everyone.
A
working
group,
a
group
of
people
who
met
at
cube,
con
and
other
places,
and
my
co-chair
JJ
pulled
together.
A
We
did
some
work
on
the
governance
and
and
then
we
had
been
working
on
these
security
assessments,
so
we
finalized
the
process
for
security
assessments
in
May.
That's
not
all
of
what
we
do
we'll
go
to
go
through
a
whole
bunch
of
different
things
that
we
do.
The
policy
group
has
an
initiative
around
formal
verification.
B
All
right,
thanks
Sarah,
so
we're
going
to
start
with
a
couple
things
to
do
and
we're
going
to
detail.
So
some
of
this
we
started
initially
when
we
had
the
safe
working
group
so
such
as
security
assessments,
and
then
we
also
have
projects
that
kind
of
came
out
from
you
know
someone
the
community
said:
oh
I
wanted
to
do
something
so
like
one
example
of
this
is
continuity
security
day
where
someone
just
said:
let's
do
something
for
Q
cotton
and
then
we
had
Michael
and
Emma
D
volunteer
and
it
became
a
thing.
B
So
one
of
the
things
that
we
do-
and
this
is
kind
of
every
meeting-
that
we
have-
we
meet
every
Wednesdays
and
we
usually
have
some
discussions,
some
presentations,
so
so
quite
a
wide
spectrum
of
this
one
example.
Our
presentations
we
have
is
the
use
cases
so
and
one
of
the
cube
cons,
someone
came
out
and
said:
oh
I
have
this
interesting
use
case
where
I
use
FinTech
for
kubernetes,
where
it's
a
highly
regulated
industry.
I
would
like
to
share
about
this
right.
So
we
we
had
income
in
the
solute.
B
He
talked
about
his
use
cases
kubernetes.
You
know
how
they
handle
compliance,
regulations
and
stuff
like
that
right.
So
we
have
the
use
cases
if
we
also
have
community
people
from
the
security
community
talking
about
the
security
reviews,
so
we
had
a
sneak
peek
into
the
kubernetes
security
review
by
trio
of
bits,
and
we
also
had
falco
talked
a
little
bit
about
the
security
review
process.
They
did
with
CN
CF
and
we
also
have
a
couple
presentations
where
people
just
talk
about
technology
right.
B
B
B
So
another
thing
that
we
do
is
impress
a
meet-up,
so
this
is
usually
at
locations
like
this,
so
coupon
stalker,
cons
and,
in
fact,
we're
actually
meeting
up
tonight.
So
if
we
are
gonna
be
around
the
puppy
Palooza
area
around
7:15,
so
if
you're
interested
to
come,
hang
out
grab
a
few
drinks
grab,
some
food
meet
our
staff.
That's
the
issue
open
there.
So
if
you
go
there,
you'll
find
some
more
details.
If
not,
if
you
probably
find
they'll,
be
probably
something
on
Twitter,
so
he's
a
search
for
hashtags,
execute.
B
B
Alright,
so
another
example
of
emphysema
doubt
is
cottony
de
sécurité
de
so
this
happened
yesterday.
This
was
something
that
was
proposed
by
the
community,
and
so
we
had
this
day
where
we
had
a
bunch
of
speakers
talk
about
security,
the
use
cases,
and
we
also
had
this
unconference
style
discussions
going
on.
So
one
of
the
pictures
you
can
see
is
people
proposed
a
bunch
of
topics,
and
then
we
get
at
this
moment.
So
also
it's
a
really
nice
discussion
and
I
think
this
is
something
with
that.
B
We're
going
to
see,
hopefully
again
in
the
next
Q
crunch,
all
right.
So
one
of
the
things
that
Sarah
mentioned
early
during
the
overview
was
security
assessments.
So
one
of
the
things
that
we
do
in
six
securities,
we
perform
security
assessments.
So
these
security
assessments
are
really
to
look
at
cognitive
projects
that
are
security,
focus
or
not,
security
focus
and
to
kind
of
do
one
or
two
things.
B
So
one
is
to
evaluate
the
the
ecosystem
and
the
see
where
this
project
is
in
terms
of
security
in
the
Prieta
ecosystem
right,
and
the
second
thing
is
also
to
look
at
general
security
hygiene
of
the
project.
So
this
is
a
little
different
from
the
the
paint,
security
audits
or
reviews
where
they
really
look
at
the
details
of
the
code,
find
particular
bugs
in
it.
What
we
do
is
we
look
at
the
overall
design
of
the
system.
We
say
we
have
a
good
gauge
and
say:
okay,
does
this
look
like
a
secure
design?
B
B
Do
they
have
a
security
maintainer
and
do
they
have
good
response
rates
on
those,
so
the
security
assessment
of
what
we
aim
for
we
had
a
set
of
guidelines
that
we
put
down
it's
a
three
week
thing
and
it
really
starts
with
someone
saying
that
like
to
have
a
security
assessment
done,
so
we
create
a
tracking
issue
and
the
project
feet
whose
project
being
assessed
will
have
a
self-assessment
done.
So
this
will
be
you
know.
What's
my
project
about
here
are
some
questions
about
security
that
we
want
answered?
B
What
which
parts
of
the
project
touch
data?
What's
the
track
models
and
stuff
like
that,
and
then
we
will
get
into
a
review
space
where
the
security
beat
will
first,
initially
look
at
this
assessment
and
clarify
the
details,
and
then
the
review
group,
which
is
usually
three
to
five
people,
will
look
at
the
depart
of
the
assessment
every
day.
There's
going
to
be
a
back
and
forth
conversation
about
okay.
What
does
this
mean
for
security?
Are
there
ways
everything-proof
on
this?
B
A
Yeah
I'll
talk
a
little
bit
about
a
couple
of
the
other
projects.
Landscape
was
a
project
that
we
did
about
a
year.
We
had
some
volunteers
from
the
community
who
reviewed
all
of
the
CNCs
projects
in
the
landscape
and
tried
to
bucket
them
and
tried
to
figure
out.
How
do
we?
Our
goal
is
to
divide
the
landscape
into
categories
of
light
where
something
everything
would
fit
into
one
category:
that's
how
you
think
about
security
right,
it's
different
from
the
landscape.
A
It's
not
the
functional
categories,
but
when
you're,
when
you've
got
a
security
product,
how
do
you
you
know?
What's
it
for,
and
it
was
very
challenging
to
come
up
with
these
categories,
where
you
know
everything
doesn't
just
go
into
one
category,
so
what
we
did
was,
which
is
something
we
frequently
do.
A
Is
we
put
up
a
draft
and
then
it
sits
there
for
a
while
and
I
was
kind
of
worried
that
it
was
going
to
just
sit
there
and
definitely
what
people
like
saying
that
they
didn't
like
it
and
then
just
this
summer
of
this,
in
the
last
couple
of
months,
we've
had
some
new
PRS
which
are
I.
Think
these
are
both
still
open,
which
are
proposing
how
to
adjust
it
to
clarify
the
wording,
and
so
this
is.
This
is
how
the
group
works.
A
So,
even
if
you
can't
come
to
our
meetings,
I'd
encourage
you
to
dive
if
you're
interested
in
security,
if
you
want
to
contribute
or
just
learn,
more
learning
by
doing
is
kind
of
how
our
group
works.
We're
mostly
security
experts.
Yet
none
of
us
knows
everything
about
cloud
right
and
that
exchange
of
knowledge
is
really
enriching.
A
A
Our
initial
personas
were
in
a
developer,
operator,
administrator
and
end
user,
which
we
defined
differently
than
the
CNC
F,
because
the
CNC
F
defines
end
user
as
the
end
user
who
implements
cloud
native
stuff,
but
then
they
don't
have
that
sort
of
takes
over
the
word
for
the
end
user,
who
uses
the
application,
that
is
deployed,
clown
item
and
from
a
security
standpoint.
Of
course,
we
have
to
worry
about
the
people
who
use
the
cloud
native
system,
so
just
so
in
in
this.
A
Since
the
last
cube
con
cushion
Kemper
introduced
the
platform
implementer
persona
that
when
we're
implementing
cloud
native
platforms,
we
have
a
set
of
other
concerns,
and
so
each
of
these
personas
has
a
bunch
of
use
cases
so
that,
as
we
develop
systems,
we
can
think
through
the
security
use
cases
for
those
different
personas,
and
this
is
helpful
to
the
different
members
of
the
group,
and
we
hope
also
for
people
outside
the
group
and
then
last.
The
last
product
I
want
to
go
over
is
the
supply
chain
initiative.
A
So
this
is
something
that
it's
always
been
a
problem
like
you
could
always
have
had
a
threat
to
the
supply
chain,
but
before
the
fast
moving
you
know
deployments
of
cloud
before
this
significant
rise,
independent
of
dependence
on
open
source
supply
chain.
Wasn't
that
much
of
an
issue.
But
now
it's
common
for
a
project
to
just
suck
in
a
thousand
dependencies
at
once
and
frequently
not
review
the
changes
from
one
thing
to
another
and
so
Santiago
Torres
who's.
A
The
maintainer
of
in
toto
contributed
this
list
of
compromises
that
he
had
cataloged
in
in
coming
up
with
in
toto
and
then
there's
enthusiasm
in
the
group
to
categorize
it
so
that
we
can
really
understand
how
we
think
about
the
supply
chain,
threats
and
also
start
to
investigate.
Are
there
projects
to
the
left
of
and
Toto
to?
B
All
right,
so
how
do
we
get
involved
with
security?
So
we
have
everything
that
we
do
is
in
github.
So
if
you
just
go
to
our
github
page,
there's
a
bunch
of
links
that
will
be
helpful,
we
meet
every
Wednesdays
at
10
a.m.
PST.
The
details
is
going
to
be
in
sites
later
so
everything's
gonna
be
in
github
or
whatever
we
talked
about.
There's
gonna
be
issue
a
pull
request
or
further
and
github
that
it's
it's
gonna,
be
there.
B
So
if
you're
interested
in
any
of
this,
you
can
go
to
a
github
repository
and
also
we
have
a
side
channel
in
the
CNC
f6.
So
you
can
come
by
and
drop
us
a
message.
So
there's
a
lot
of
information,
that's
out
there,
and
so
we
have
this
new
members
section
on
our
landing
page.
That
basically
tells
you
all
you
have
to
do
so.
What's
our
mailing
list,
sorry
there's
also
acteam.
B
What's
the
code
of
conduct
stuff
like
that
how
to
get
involved-
and
you
know
once
you're
part
of
the
community-
how
to
add
yourself
to
the
community
and
I
think
one
of
the
things
that
we
really
promote
in
the
group
is
really.
If
you
have
an
idea,
if
you
have
something
that
you
want
to
do,
we
encourage
anyone
to
do
it,
even
though
you
can
come
to
the
meetings,
and
so
we
set
up
a
bunch
of
templates
for
issues.
So,
for
example,
we
have
right
now
a
presentation.
B
So
if
you
want,
if
an
idea
for
a
presentation,
if
you
want
to
see
a
certain
presentation
or
project
or
technology,
you
can
create
the
issue
that
and
then
we
have
these
things
called
proposals
and
suggestions.
So
suggestions
are
for
things
that
you're
interested
in
that
you
want
to
see
happen,
but
you
don't
necessarily
have
the
resources
to
do
it.
So
you
can
put
out
a
suggestion
and
say
that
saying
oh
I'm
interested
in
this
topic.
B
B
B
B
So
we
also
have
a
security
assessment,
so
if
your
project
in
the
CNC
F
or
you
are
thinking
about,
you
know
submitting
a
project
for
sandbox
in
CNC
F,
then
if
it
security,
rater
or
if
it's
not
security
related,
you
can
submit
a
request
for
security
assessment
and
then
fill
up
the
the
the
self
assessment
and
then
we'll
go
through
the
process.
Yeah.
We
are
still
looking
for
first
five
security
assessments
that
we
do.
B
A
So
we're
basically,
we
have
a
process
and
we're
sort
of
testing
the
process
with
with
five
security
assessments,
so
that
we,
you
know
like
Brendan
said
we
had
to
our
goal-
is
to
have
the
four
of
the
five
be,
are
probably
going
to
be
security
related
things,
but
we
want
at
least
one
of
them
to
be
a
non
security
project
so
that
we
have
the
like
sort
of
experience
of.
How
do
we
talk
through,
like?
B
B
This
could
be
done
by
JJ
and
it's
a
punk
who
I
don't
think
it's
here,
but
if
you
want
to
get
more
involved,
you
don't
find
out
more
about
what's
going
on
the
assessments
and
things
like
that
do
drop
by
tomorrow
and
find
out
more
the
psych
information
is
here
and
if
you
all
this
information,
that's
over
here,
if
you
go
to
our
github
page
CN
CF
sick,
that
security-
all
of
this
will
be
there.
Thank
you
so.
A
C
My
name
is
Kapil
I
heard
that
the
incubation
process
for
projects
going
to
CN
CF
changed
in
the
last
few
months
and
they're
not
going
through
the
cig
to
the
CN
CF
six
first
before
they
go
to
the
talk
and
I'm.
Just
trying
to
understand
like
it
seemed
like
your
party
assessment
stuff
is
actually
generic.
It's
not
per
se
security
related.
It's
just
project,
good
health,
the
badge
app
et
cetera!
Is
it
like
I'm,
just
Ryan
understand
what
that
process
is.
Is
that
a
proposal
is
that
a
presentation?
A
A
It's
like
phishing
attacks
like
there's
a
bunch
of
things
that
are
seriously
security,
things
but
they're,
not
really
different
in
cloud
native,
but
then
there's
other
things
that
are
kind
of
on
the
edge
right.
It's
things
that
are
becoming
cloud
native
and,
and
so
the
the
does
it
belong
in
the
CN
CF
is
more
about
like
does
it
do
a
cloud
native
specific
thing
like?
A
Does
it
enable
cloud
native
in
some
way,
and
so
the
due
diligence
process
may
be
briefer,
like
okay,
we'll
just
have
one
or
two
people
like
write,
something
up
and
be
like?
Okay,
like
more
like,
do
some
homework
for
the
TOC,
which
used
to
be
done
before
SIG's
existed.
There's
these
toc
contributors
so
like
anybody
can
sign
up
to
be
a
TOC
contributor
and
that
just
means
that
the
TOC
might
call
on
you
and
be
like
hey.
Could
you
do
a
thing
to
help
us
out,
so
it's
expanding
the
bandwidth
of
the
TOC?
D
Thanks,
this
actually
isn't
so
much
a
question
is
a
quick
I'm.
I
actually
lead
the
CI
a--
best
practices
project,
so
I
mean,
and
the
CI
a--
best
practices
badge
is
specific
to
the
cnc
f.
It
does
have
things
beyond
security,
because
g,
if
the
project
fails,
it's
probably
not
going
to
be
secure
either,
but
it
does
focus
on
security.
On
the
other
hand,
the
badge
project
doesn't
do
a
lot
of
things
that
the
sake
security,
things.
Oh
so,
hopefully
we're
synergistic
and
so
on.
Yeah.
A
In
fact,
we
do
look
at
the
status
of
the
badge,
and
one
of
the
things
that
we
try
to
do
is
like,
like
the
answers
to
the
questions
in
the
badging
process
are
sometimes
more
important
than
I
got
to
gold
or
silver
or
whatever
right
like
there's
the
lowest
level,
where
kind
of
every
project
should
be
at
and
then
after
that,
depending
on
the
project.
Sometimes
there
are
things
that
are
in
the
gold
category
that
are
more
important
than
the
silver
category,
and
so
we
really
look
at
what
is
the
project
for?
A
E
A
So
I'll
take
that
so
yeah
there's
been
also
a
lot
of
discussion
that,
basically,
until
we
do
this
first
five,
we
don't
want
to
make
it
required
because
we're
still
validating
the
process
and
our
goal
is
to
be
able
to
do
an
assessment
in
three
weeks
which
we
haven't
hit
yet
so
until
we
can
like
and
maybe
it's
for
whatever
it
is.
Until
we
can
tell
a
project,
it's
going
to
be
this
much
work.
It's
going
to
take
this
much
time.
F
So
my
question
is
very
similar
on
your
set
of
the
tasks
of
what
you
do.
I
didn't
notice,
any
sort
of
proactive
outreach
to
the
other
projects
and
I
think
you
just
answered
part
of
it,
which
is
we
can't
really
scale
until
you
have
part
of
that.
What
other
things
are
you
doing
in
terms
of
policy
and
kind
of
the
broad
view
into
the
community
to
help
all
the
projects
are
all
the
ecosystem,
with
their
security
level
of
maturity?.
A
So
all
of
the
material
is
available
just
all
in
the
repo
and
you
kind
of
have
to
dig
in
there
with
and
that's
kind
of
intentional,
because
where
there's
it's,
there
are
some
holes
there
right.
There
are
things
that
we
all
think
are
important,
but
they're
not
addressed
at
all
in
our
materials,
because
it's
just
you
know
if
there's
bandwidth
concerns.
B
I
think
there's
some
discussion
also
around
the
landscape
that
stem
solved
that
and
they're
like
okay.
So
one
of
the
things
that
came
up
was
authorization
identity
and
should
that
be
something
that's
a
call-out
to
another
project,
or
is
it
something
that
every
project
should
really
focus
on
every
everyone
should
have
something
that
is
related
at
the
authorization
identity?
And
you
know
the
discussion
is
still
going
on,
but
these
these
actually
come
up
and
they're
sort
of
good
and
valid
points
on
both
sides.
So
I
think
part
of
what
we're
doing
is
you
try?
A
Really,
the
first
step
that
we're
planning
to
do
is
we're
planning
to
do
a
micro
site
that
is
like
you're,
not
part
of
the
group
but
you're
interested
in
cloud
native
security
like
and
that
the
content
will
be
over
the
last
couple
of
years.
We've
had
a
number
for
the
presentations
like
if
you
look
at
all
of
our
meetings
that
are
all
on
video,
90%
of
them
are
not
like.
It
would
take
a
long
time
to
slog
through
them
to
get
the
information.
A
That's
really
awesome,
but
the
presentations
are
gems,
and
so
we're
going
to
take
those
presentations
on
the
CNC
F.
It
has
produced
transcripts
so
that
those
highlights
of
those
presentations
so
at
first
we're
going
to
just
say:
okay,
this
is
the
stuff
that
we've
been
doing
for
ourselves.
These
you
know
small
set
of
commuting
security.
Experts
in
the
community
now
will
echo
that
out
to
the
community
and
then,
as
we,
you
know,
sort
of
formalize.
What
we're
doing
will
then
have
more
resources
for
the
community.
B
B
G
Just
wanna
say
in
response
as
well:
I
think
we're
not
specifically
entirely
focused
on
projects
as
well.
I
mean
we,
we
a
large
amount
of
the
stuff
we
do
is
trying
to
help
users
understand
how
to
use
projects
as
part
of
the
that
work
goal
of
the
assessments,
so
we're
kind
of
resource
for
that,
and
then
we
have.
G
You
know
broader
themes
like
the
policy
working
group
had
this
whole
strand
on
on
use
of
formal
methods,
and
things
like
that,
you
know
so
there
are
sort
of
bits
of
tooling,
rather
than
specific,
everything
being
specifically
focused
on
the
C
and
safe
projects.
It's
a
it's
a
kind
of
broader
focus,
but
we're
really
happy
to
engage
if
projects
want
to
come
to
us
and
engage
that's
great
as
well.
H
This
may
be
a
bit
out
of
scope,
but
with
respect
to
not
just
say
developers
or
maintainer
zuv
individual
projects,
but
downstream
consumers,
so
rather
than
implementers
at
customers
that
are
using
it.
Is
it
appropriate
to
direct
them
to
this
to
the
six
security
group,
or
would
that
just
overwhelming
them
like
treating
it
like
a
support
desk
like
if
an
implementer
is
trying
to
do
say
an
app
and
they're,
essentially
using
all
CN
CF
components?
Is
it
appropriate
to
point
them
your
way
to
sort
of
yeah.
B
We
do
have
a
lot
of
discussions
that
go
across
the
stack,
I
think
we
we
do
have
quite
a
significant
amount
of
discussion,
switch
end-users
and
how
the
security,
so
so.
This
especially
comes
in
the
use
case,
presentations
and
discussions.
I
think
the
security
assessment
documents
that
are
produced
from
the
security
assessments
act
as
it's
a
good
way
to
kind
of
have
a
first
introduction
into
a
particular
project
and
kind
of
the
security
implications.
But
you
know
this
is
you
know
the
basic
it
kind
of
lays
it
out
really
nicely
about
what
the
project
is?
B
G
Yeah
we've
had
discussions
with
people
like
the
financial
services
user
group,
Angie's
group,
for
example,
who
were
obviously
heavily
involved
with
security.
So
we've
done
some
cross
presentations
with
them
and
the
people
have
become
quite
a
because
they
want
to.
They
have
a
lot
of
security
requirements
and
they
want
to
work
out
how
to
work
with
each
other
so
to
share
work,
and
things
like
that.
So
there's
a
there's.
G
A
whole
kind
of
areas
like
that,
where
we've
interacted
with
in
with
the
end
users
directly
but
yeah,
we're
I
mean
we're
not
strictly
a
helpdesk,
but
there
are
lots
of
people
only
it's
it's
a
great
resource
of
people
who
know
about
lots
of
different
areas
of
security.
So
if
you
actually
want
to
ask
a
helpdesk
question,
it's
not
a
terrible
place
to
try
I
think.
A
The
main
thing
is:
if
you
are
not
a
security
expert
and
you
want
to
roll
up
your
sleeves
and
help
document.
The
answer
to
the
question
you
asked
come
on
in
the
water's
great
right.
It's
really
that
if
for
people
who
want
to
learn
by
doing
and
we've
had
people
who
don't
have
any
expertise,
security
reviewing
and
we've
kind
of
created
a
path
where
somebody
can
act
as
a
security
reviewer,
we
make
sure
that
we
have
at
least
three
experts
and
we
kind
of
balance
the
expertise
around
background.
I
A
We
are
what
we
do
in
the
security
assessment.
Make
sure
that
the
project
has
one
and
like
one
of
the
things
that
we're
we're
doing
is
trying
to
amplify
when
we
think
a
project
would
benefit
from
having
more
companies
participate
in
that
response
or
more
people
on
their
security.
If
it's
a
widely-used
project,
but
only
one
company
is
on
the
security
team,
will
you
know
we're
trying
to
figure
out
ways
that
we
can
amplify
the
things
that
would
really
make
a
difference
if
companies
participated,
because
we
know
that
companies
have
many
many
dependencies.