Cloud Native Computing Foundation KubeCon + CloudNativeCon North America 2022, 11 Nov 2022

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: SIG Security: Empowerment Through Autonomy - Ala Dewberry, Savitha Raghunathan, Tabitha Sable

Description

Don’t miss out! Join us at our upcoming event: KubeCon + CloudNativeCon Europe in Amsterdam, The Netherlands from April 17-21, 2023. Learn more at https://kubecon.io The conference features presentations from developers and end users of Kubernetes, Prometheus, Envoy, and all of the other CNCF-hosted projects.

SIG Security: Empowerment Through Autonomy - Ala Dewberry, VMware; Savitha Raghunathan, Red Hat; Tabitha Sable, Datadog

Speakers: Savitha Raghunathan, Tabitha Sable, Ala Dewberry
SIG Security takes a community-building approach to improving Kubernetes security, both for the project itself and our end users. Join organizers Ala, Rey, Savitha, and Tabitha for an overview of how we make space for security collaboration to thrive. We'll share timely updates from our documentation, third-party audit, and tooling subprojects. Security self-assessments will be a special focus, with a deep-dive on this new service offered to Kubernetes by our newest subproject! The Self-Assessments subproject in SIG Security is here to make security introspection accessible to any and all SIGs and subprojects. We aim to give SIGs and subprojects a repeatable and rigorous way to think about their own security, making Kubernetes safer to use as more workloads find their way to it. You'll learn what's been going on, what’s next, and how you could join in, regardless of your experience from beginner to expert. We hope to see you there!

A

Are we on? Oh, yes, we are so on hello, folks and welcome. uh This. Is the Sig security uh talk here on the maintainer track at kubecon n a 2022? My name is Ola Dewberry I am a product manager at VMware in the office of the CTO and sub-project lead for the self-assessments sub project.

B

Hi everyone, my name, is Savita ragunathan I am a senior software engineer at read ahead. I am the sub Project Lead for six security, documentation.

C

And hello, I'm Tabitha Sable I'm, one of the co-chairs of Sig security I'm, also a member of the kubernetes security response committee and uh staff engineer at datadog, focusing on infrastructure security, so click for me, So yeah. Thank you. So much for coming to hear a little bit about Sig security. I'm super happy to share it. We are a horizontal Sig that works with all of the other sigs within kubernetes. Two continually improve the security of this kubernetes project, both the software and the user, experience for our users and also things within the project.

C

So the way that we do. This is really specific. We focus on building Community, we focus on building relationships within kubernetes and with folks out in the rest of the world, because kubernetes is a is a large and complex project, but even in something simpler, security is not the sort of topic that one person or one entity or one Authority, can assure for a project for an organization for anything, and so since any contributor can potentially make the security of the project Better or Worse, we are focused on ensuring that everyone has.

C

The possibility to come together, learn share what they know and together improve the security of the project. So we do this by making documentation process and feature improvements within kubernetes, so that means that sometimes some caps appear in a related Sig and they say to themselves this has this has security implications? Let's also go in and talk with the six security folks about it.

C

Sometimes sick security, folks, I, don't know wake up or or get out of the shower, or you know, whatever sort of thing gives you ideas, sometimes sick security folks, say I, wonder about, and then, when that happens, we we discuss it. Everybody brings their thoughts, their experience and sometimes those things go out to other cigs and we say sick security has been thinking about this. We wonder what you think about it. Is this something that you'd like to work on together and then then that happens, and then we see caps.

C

We see improvements and it's all based on talking to each other, sharing our learnings and using consent with each other. So we also provide some security related services within kubernetes. We'll hear a little bit more about that when we get to the tooling subproject and we also serve as the public forum for the security response committee security response committee meetings are private due to the nature of the work, but as the SRC.

C

It's our job to help and support kubernetes, and that means that we need to be able to talk about some of our decision-making processes and things like that in a public forum and seek security, provides that as well. So that's that's what we are and that's how we do.

A

C

We will move on to Savita to hear about doc, subproject.

B

Thank you Dobby, so kubernetes website is awesome right. We all have used it and we still use it close to the seek documentation. Folks, I know I, see some other faces here and all the contributors who have contributed to make it awesome. What do we do here? So we want to just enhance the documentation by creating a security awareness, and we do that by adding tutorials security tutorials and then, like more security, related examples and keeping the things up to date. Right we don't want to have an outdated example.

B

Then you just copy paste it into a cluster, and then there you go. You just created a nightmare for yourself, some other some on some other day, not on the same day. So that is the major goal of this project, and some of the recent highlights of this project includes the Most Wanted feature kubernetes security list, so we have recently published the kubernetes security list and all these are hyperlinks. So once the slide is available, you should be able to click on it. We recently published it.

B

It's focused on Focus for the admins and we are hoping to administrators and we are hoping hoping to expand it to the application developers and whatnot, and the next one is that API risk API server bypass res post by Rory, and there is also the historical context on PSP, so we all talked about PSP for how long three four releases or more than that and finally, the PSP is duplicated and we want to know like what was like history of it right. It's it's a it's a nice little thing.

B

It's like a trivia thing, so one of the contributors published a post and my favorite thing is the historical chart like. If you go to the blog post link there, you can see like the timeline, and that is my favorite uh part of the entire blog. In addition to all the Tas, of course um thank you.

B

um So what are we gonna work on? So we have some major goals, but the first up is the hardening guide. We have already had it and then it cut off was a very big project, so it kind of died down and um it has been finally revived um and thanks Kalin.

B

um So we are gonna this time. We're gonna do a little different, so we're gonna divide it by into multiple little tasks so that new contributors existing contributors, whoever wants to like contribute, can come in and take a piece and support that into the project. So that is the major idea of that one and then we're gonna add more tutorials, mainly our back.

B

um That is like one of the goals, personal goals that I have hopefully I'll get to that or like I'll. Let any of the awesome contributors get to that, and uh another thing that we have been talking about is the confidential kubernetes. So that is quite the bus and we are, there are like awesome contributors again working on a blog post, so look forward to that sometime in the quarter next quarter sometime next year, hopefully so we'll we'll get that out. So those are the interesting things that we are working on.

B

We are also in need of contributors. So if you, if any of these things, is interesting to you just stop by our uh meeting and uh stop by our slack Channel, um you can stop by and say hi and seek security as well. um So that's all from dogs, I'm gonna, pass it to Tabby for audit.

C

Yeah, thank you so much. uh We have third party audit sub project, which is organized by my fabulous colleague Ray, who you may also know from the release team and Sig Docs and the third party audits. A project focuses like you would guess, from the name on facilitating periodic professional external audits of the kubernetes code base, and this provides us a couple of different values.

C

It helps to serve as a check for the work that all of the contributors and maintainers are doing all of the time to represent security needs within the work that they're doing every day, and it helps to discover new potential problems so that we can address them earlier before. Hopefully, they are discovered in the wild and used for some kind of harmful purpose.

C

Organizing a professional code, audit of a large project like kubernetes, requires lots of logistics requires a lot of communication with the selected vendor in order to help to guide them through an effective way to take a journey through the huge code base and the folks from the audit subproject have done a great job of sharing their expertise with our vendor. In order to get them into the right places and find things that might go bump in the night, they've recently published a blog post about a retrospective of the previous audit that completed in 2019.

C

It is talking about the status of the various issues that were found in that audit, and so we want to thank Caitlin, pushker and Rory for the work that they did getting, that blog post together.

C

The current audit that started in late 2021 has wrapped up and the results from it are being reviewed within the security response committee. So we will see the full report from the Auditors published as soon as the private response is completed and they're, making sure that what they learn from going through this process also gets shared back with the folks in the security, self-assessment sub project and the folks in cncf tag Security in order to get all of the learnings shared around everywhere, so that we can all continue to get better from each other's experience.

C

So I'll give this back to Savita. No we're done I'm, giving it to Allah. Oh, oh, it is Savvy, tougher tooling. Thank you.

B

uh Thank you, Tabby. Thank you, Ray for the audit, the project leading the audit to project an amazing way next on the tooling, so this project is led by my cool friend and an awesome. Contributorial gliger and I'm gonna talk uh on behalf of pushkar. So what do we do here? We build and enhance security through code, and we do that by collaborating with various projects and other various six in the kubernetes and the project is the product meets every other week on Wednesdays and they alternate between a working session and then a learning session.

B

The learning sessions awesome super cool, and if you are someone in the industry or like or someone like us learning and building kubernetes security tools, you can sign up in the list and then come show off whatever that you have learned or whatever the tools that they are built or like. If you even find something like super cool, that's related to kubernetes security, you can just bring it here, and um that is that is. That is really awesome, um and uh that is one of the uh highlights of the uh tooling project as well.

B

And um so, if you are like me right so how many of you used to subscribe to the security announced mailing list and whenever there was a CV announced, you read through it and you're like oh, my God I need to update this I need to like patch. My servers I need to do this and then, like after two days, I have thousand emails shift, delete or like control, delete right, it's all gone uh and then, like you, you cannot find the information in a mailbox.

B

Then you have to go to the Google Groups and like search through and whatnot. So the tooling people, um automated everything and it is available in a kubernetes website- that's linked and we got amazing feedback from the community and the rest of the announcement is in kept three two or three I hope. I got that right, yeah three to O three so like. If you're interested you can go and check that out. If you have any feedback and import it they're all welcome.

B

um So that is like the major highlight that's been going on and um oh, we also have vulnerability scanning.

B

So the kubernetes CI, which builds the um images container images and also the code itself, so there is this vulnerability scanner that has been attached um to everything now, so you can get the reports and uh what else yeah and then, like we I, as I, saw as I told, although, as the goal suggested, that we work with every others approach, every project of security and also various things, that's all about tooling and I hope I did Justice to the two links of project. Thank you. uh Next, on to uh self-assessment from Allah.

A

Mind if I scooch over here, yeah, so hello, folks so and Now for Something Completely Different for those Monty Python fans out there all right so self-assessments. What are we going to talk about so first we're going to do a brief overview of some history um in terms of the Cappy self-assessment that was just completed and kind of how self-assessments came to be in kubernetes.

A

Then we're going to go through some tactical items like uh what is the goal of a self self assessment, and how do you do it and how does it also at a more strategic level? How does it Empower through autonomy and then, of course, I am a product manager, so we're going to talk about some road map, all right, so a little bit of History here.

A

So in six security, we are big on the values of learning and consent, and that's definitely how this self this this sub-project got started so um and I'm gonna look to push Kerr and Tabby to keep me honest here, because I wasn't here for this piece of history.

A

But what what has been recounted to me is that um Cappy reached out to six Security asking for help, realizing that they're a pretty important project in kubernetes, and if there were security, um you know vulnerabilities or issues with it that uh that could be pretty catastrophic so best to take a proactive stance to kind of uncovering that so, of course, uh pushker jumped in with his experience from working in the cncf tag, Security, self-assessments, Group and said: hey, you know, I'm gonna go ahead and rally the troops here to do a self-assessment in kubernetes for Cappy and we're gonna see how that works and tldr.

A

It was overall a positive experience and I think it was the first six security meeting that I came on um that we were talking about hey. You know this kind of needs to become a sub-project. Now this was successful. This is some. This is a tool and a framework that we want to reuse in the kubernetes community and I had the amazing, pleasure and honor of merging the Cappy, self-assessment, PR and yeah.

A

So thanks again to pushker, for um you know, just getting it started and organizing it and creating an opportunity also for someone new in the community to get involved all right so with some history out of the way. Let's talk about some goals so for an individual self-assessment, there are two basic goals. So it's to answer two questions. So it's basically, what is the security posture of the workflow in the project that we've modeled and then how can we improve it?

A

So pretty simple um and then, of course, your you know capture the action items that you've done from the assessment and um you know making sure that we take those actionable things and that we actually make the improvements now for the sub project as a whole.

A

um My thinking in terms of a really good, North, Star and totally welcome for feedback on this from the community would be to fill our repo with self-assessments for all the projects and sub-projects in kubernetes I think that that would be so so cool. But again, let's, let's work on and iterate on that and that goal and that Vision together all right so part one. How do you do a self-assessment, so, just at a high level, a self-assessment is the process of just mapping out a targeted workflow in um in use by the community.

A

um That's step one then building a threat model for that workflow sort of like given the scenarios. What could go wrong? What are the attack factors that could be exploited um and then, of course evaluating the security posture of the workflow based on that threat model of the current day? So it's like what are the security controls that we have in place today, and would they be effective against the scenarios that we have decided to model out?

A

So that's really at a high level, but let's go a step uh deeper in terms of what this is here. So the first thing, the first sort of event that happens, that tells us hey, we need to do a self-assessment is that we receive a request. So we do have an intake system in GitHub setup so that you can go ahead and request sick security to to do a self-assessment. So that's the first thing. The next step is to find your people.

A

So, given uh the project or sub-project that wants and has requested a self-assessment, the exercise becomes all right. We need folks who are experts in the um or who have deep knowledge of uh the project or sub-project itself, how it's architected, and then we need folks who have uh skills along the lines of being able to build threat models for stuff.

A

So currently right now, the next self-assessment in the queue is for the vsphere CSI driver and I need to find Shang at some point to um you know, start coordinating that process, but it's really building your team sort of what are the skill sets that you need to make this a successful use of everyone's time. So once you've got your pupil in place, the next step is to just map out the architecture of whatever it is you're building.

A

So a lot of projects have this already mapped out, so this is usually a fairly easy step, but it's also a good exercise that, oh, maybe, if it's a little weak in some areas, you know let's go ahead and Tackle this. You know we can't secure what we can't see. So, let's do it so, with that architecture mapped out, then you can start to look at okay.

A

What are the sort of highest priority areas that we would want to do a threat model, for um you know- and this is generally I- actually asked this for the vsphere Cs Drive driver. You know what's the priority: what's the used the most in the community, because that's that you know represents the the biggest attack surface and as it turns out, it's a vsphere CSI driver for vanilla kubernetes. So we're going to do that. First, um then, it's just a question of mapping out that workflow sort of how does data move through that system?

A

um And you know what does that look like then, based on that building out your threat model sort of how could someone who's a bit naughty, um exploit this and- and you know, potentially uh make someone's day not awesome and then to just evaluate the weaknesses based on uh sort of the worst things that you can think of that could happen and then, of course, to capture and prioritize those action items all right. So next question: how does this Empower through autonomy?

A

So the high level answers here are to make security things that are accessible and repeatable and by virtue of doing that, to Federate knowledge, I think that, at least for me, when I got started in security at vericoat a few years back, you know.

A

There's there really is a lot to learn, and while we need expertise and we need really deep and Rich skill sets and security, I think that it's also really important to make sure that we take beginners along for the ride, and we help people understand what the Smalling and incremental things that we can do to be more secure and to make doing the secure thing, relatively speaking, the easy thing.

A

So you know the framework and the process that I've mapped out are not inherently rocket science, it's really about getting the right people and the right skills together and then sharing knowledge with each other I'm, not a developer, but I'm super super excited to work with people who hack on the vsphere CSI driver and to understand more about what that project does and how it does it and to enrich my learning by virtue of that.

A

So it's really about just taking every opportunity that we can to Federate security knowledge, which is you know, done by doing things like you know, socializing this framework and socializing sort of the more human concepts of building your team. Getting the right skill sets together for success all right. So how are we going to keep empowering through autonomy so by virtue of arming uh the community with a simple set of tools to you know raise uh raise the tide so to speak in terms of our security posture?

A

um You know it's really a question of socializing this tool, who needs who would like um a self-assessment who who wants to learn about how to do one? Do you want to participate in one? Even if it's not your sub project? Those are it's about inviting people in for the journey.

A

um Of course, when you socialize things and you ask for feedback, you get feedback which means that you can improve it and refine it. What a concept and then, of course, in a more tactical sense, like I've, been saying um the vsphere CSI driver, self-assessment, is next um and my open invitation to everyone is to come. Join us.

A

um Actually Savita introduced me to someone who is in this audience right now, who's interested in getting started and we're going to go on this Learning Journey together, and it's it's going to be great, so I'm really excited and um also actually this is I should almost cross this one off complete the Retro for the Cappy self-assessment. We actually, uh some of us got together in the speaker, lounge and we chatted. We shared a bunch of things.

A

I made a little stickies dot, IO uh whiteboard and captured a bunch of stuff, so I'll be putting that in the Cappy uh self-assessment slack, Channel and I'll probably also put that in this, uh the six security Channel too just to just to share you know, retroing is important um and then, of course, uh you know what could be more important than trading uh learnings with our our um with other fellow organisms, yeah different peers, of course, um so of course, working with pushker and uh Robert facaglia and others um in the cncf tag.

A

Security to you know just make sure that we're keeping an open, Open Door in terms of sharing learnings, as we both um do things on the kubernetes level and at the cncf level, all right folks so come join.

A

The fun and Sig security again I was like I knew nothing about kubernetes and I argued that I still know very relatively speaking to many folks in this room, pretty uh not very much, but um six security is a really wonderful, open and welcoming place, and if you want to learn more um or you're curious or you have questions, come, join the fun we're open on slack 24 7, and um that link is uh to our mailing list.

A

And if you sign up for our mailing list, you get added to the bi-weekly meetings, which are 9, A.M, Pacific, 12 p.m, Eastern um every other, Thursday, so yeah come join. The fun come, have a hunk with us, of course, and yeah. Thank you so much. It's been a real pleasure to uh to do this with with you all and uh yeah I believe we have some time for questions.

D

Thank you. This is awesome, so thank you very much for this um I uh where do I sign up, but at Ingress nginx to the list, because we need this besides running through the self-assessment and making sure you're doing that quarterly. What are some suggestions that you would have to help increase the security of a project because I know when I get a security release from you? Tabby, it's not fun, but what are some things that we can do to help secure the projects?

D

I know it's a very general question, but it's a security is very general yeah.

C

Yeah um I'll start with the specific part. First, you literally can sign up. If you go to the uh kubernetes Slash Sig security, repo on GitHub, you can go to file an issue and there's an issue template for registering your sub-project's interest in having help from Sig security to go through the process of doing a self-assessment um more generally, at that level of generality.

C

What I'll say is there is no substitute for caring and so by showing that you care, like this I, would say, you're already doing the single most fundamental thing, because all of the work that we do to develop or maintain software has the ability to improve or harm the overall security of the software and so, to whatever extent, the expertise that you have allows, keep security topics in mind when you're doing the work, you know ask yourself when you're designing a feature if I wanted to use this feature to harm someone, what could I do with it and that can go into a lot of different ways.

C

You know that can go into things like intentional misuse of features that can go into finding. You know Finding bugs like finding tarsing errors or type confusion errors in network protocols. It can that.

C

This can lead to a lot of can lead to a lot of places and the the other thing that I would say is to continue to stay curious.

C

So that means asking folks that you know have more knowledge or experience than you asking them for help when you can reading about the topics that are either relevant to your imagination or relevant to the work that you're doing I really see the role of a security professional as a helper role like I, am able to spend all of my professional time learning cool, terrible things that you can do with software.

C

But that means that I don't get to spend all of my time with anybody's particular piece of software with you know the uh you know, with with the Ingress engine hex controller, with the vsphere CSI driver, the folks who are doing the development they get to spend all of their time with that. And so then we can meet in the middle there, where I can learn something about like what you're doing or you know what whoever I'm trying to work with is doing, and they can learn something about more General Security properties.

C

And then we can leave having improved the project and also both learn. Something so yeah I would say care at all, which you're already doing great at um do your best and be curious and keep learning.

C

Yeah I'd love to love to pass that along.

A

Yeah I just wanted to highlight, like the part about getting social um and and like sharing, sharing your curiosity honestly and sharing um hey I'm thinking about security. I would love to get other folks thoughts. You know, especially with you know, folks, who are your peers folks, who are more uh junior to you too.

A

um It's really about bringing that security like making it as incremental as we possibly can um to be secure a little bit all the time um so to speak. um That's where you're gonna see the biggest gains, because changes always happen at the margins um in in some way, shape or form and um but yeah I think getting social staying curious, but also like persisting and circulating. Your curiosity is so powerful foreign.

B

So I want to say one thing: if you are reviewing something right, secure software development, if you are reviewing something you have the slightest hint or like I, think I need to get it, get a sign on sign off from a security person or like I want them to take a look at this piece of code or piece of documentation.

B

That is also a great place to like get it done from the start in the right way, because you know it's easier to find it find I mean it's not possible to find everything I'm, not saying that we can do everything, but it's sometimes it's easier, because the third party will have the ice for something that you missed, and it would always be nice to get like a another opinion. So that's! That's all I wanted.

E

On the nginx, you know Ingress security kind of issue. We have some researchers that are working on actually looking at the runtime packets that are coming in evaluating changes. You know what what's going on.

E

This is a pattern that we think you know should should be looked at deeper and then finding you know, Privacy, Information or whatever you know, security kind of data, that's being passed across that the guy's name is David Harris he's putting together a uh a presentation, I believe for six security and I think you guys could probably work together a little bit on that you might be interested yeah he's got a blog post coming out, he's working with uh k-native and it's the project is called Sig guard and I believe there's a little bit so yes, the social activity here having many Summits, maybe for Securities for certain portions of the horizontal space I'm a maintainer for container d.

E

I all the time coming up with security issues. It would be very nice. You know we could probably start doing some mini Summits around like we're right now we're just doing the username space isolation sort of in our own little. You know hovel it'd be nice. If we could expand that out a little.

A

C

E

More public discussions, I think yeah anymore.

D

Questions Adam.

F

So I have a question about the self-assessment process in general, um given that you're doing things about security and there's always some concern that if you are leaking a potential vulnerability or if you discover what you think is a vulnerability during the assessment process, how do you ensure that, as you're going through that that we're protecting the end user community and that we aren't, you don't expose something that could people put people at risk without something that can at least mitigate the risk.

C

Yeah those those kinds of questions um given given the roles that I have both in the private space in security response committee and the public space insect security.

C

um Those kinds of questions are always really in the front of my mind and the way that we deal with that is by trying to work as openly as we can, while making sure that we aren't sharing things until we know what they mean, because sometimes yeah, like you like you're saying sometimes as you're as you're working through threat, modeling a system or a process. You could find something that seems like a nice Improvement and let's file an issue about that someday.

C

But you also might find things that that keep you up at night and then, in those cases, the folks who are working on that know that they can contact the SRC and go through the existing private disclosure process. For that, like short circuit that you know, it doesn't have to wait until the end of the self-assessment.

E

We have time for one more question.