►
From YouTube: Staring Into the Abyss With the Security Technical... Andrew Martin, Ragashree Shekar, Marina Moore
Description
Don’t miss out! Join us at our upcoming event: KubeCon + CloudNativeCon Europe 2023 in Amsterdam, The Netherlands from April 17-21. Learn more at https://kubecon.io. The conference features presentations from developers and end users of Kubernetes, Prometheus, Envoy, and all of the other CNCF-hosted projects.
Staring Into the Abyss With the Security Technical Advisory Group - Andrew Martin, ControlPlane; Ragashree Shekar, Carnegie Mellon University; Marina Moore, NYU
The CNCF Security Technical Advisory Group provides analysis and helps guide the community at large on the most appropriate security mechanisms, architectures, design patterns, and tooling. This presentation covers an introduction to the Security TAG, their charter and scope, and highlights on several efforts the TAG has undertaken (completed and in progress) with their community impact such as the Security Reviews, Supply Chain Security Paper, Security Pals, and so much more. This session is for anyone interested in cloud native security, and wishes to understand how to get involved.
A
Thank
you
for
your
attendance
today
we're
here
to
talk
about
tax
security
and
the
work
that
we
do
as
part
of
the
community
to
support
the
efforts
of
security
in
the
cloud
native
Computing
Foundation.
This
is
the
most
devastatingly
fearful
title.
We
could
possibly
come
up
with
chewing
glass
and
staring
into
the
abyss.
Security
is
sometimes
a
thankless
task,
but
we're
a
lovely
bunch
of
people
and
we
hope
to
enthuse
you
to
join
us
on
our
mission.
I
am
relentlessly
Hawking
the
book
that
I
wrote
last
year
doing
a
book
signing
at
the
booth
later.
A
If
hacking
kubernetes
is
of
interest
to
you
and
I'm
here
with
my
co-presenters
and
tech
leads
from
tax
security
to
walk
you
through
what
we
do
and
give
you
a
chance
to
ask
us
how
we
feel
how
we
feel
about
the
work
that
we
do.
Okay,
so,
first
of
all
an
introduction,
everything
is
run
through
GitHub
we
are
Developer
focused.
We
have
a
developer
mindset.
We
pay
a
lot
of
attention
to
attempting
to
divorce
the
traditional
perception
of
security
whereby
releases
are
blocked
last
minute,
understanding
of
technical
Concepts
and
problems.
A
A
A
We
hold
meetings
every
other
week
on
the
U.S
Centric
time
zone
and,
alternatively,
the
Cadence
is
the
same
for
an
emea
friendly
time
zone
so
depending
on
which
side
of
the
pond
you're
on
or
indeed
which
time
zone
is
more
convenient
for
people
slightly
further
out.
We
hope
that
we're
there
as
a
time
zone
that
makes
contribution
possible.
A
We
just
run
meetings
on
Zoom.
Everything
is
very
open
and
everything
is
then
transcribed
into
a
working
document
where
you
can
catch
up
or
see
what
the
history
of
the
group
has
been.
We
are
a
voluntarily
LED
organization.
Everything
is
open
and
participant
driven
and,
as
you
can
see,
this
means
that
security
enthusiasts
are
the
DNA
of
the
group,
but
we
have
everybody
from
professionals
through
to
academics
and
researchers.
It
is
a
very
open
and
collaborative
space,
and
again
we
look
to
be
as
inviting
and
balanced
as
we
can
possibly
be.
A
What
do
we
do,
then?
The
role
of
tag
Security
is
to
assist
projects
as
they
look
to
graduate
up
through
the
cncf's
different
levels.
What
that
means
is
for
an
individual
project,
that's
submitted
to
the
cncf
and
looks
to
take
advantage
of
that
reciprocal
Limelight.
That
admission
to
cncf
gives
the
marketing
budgets
the
level
of
technical
quality
and
Community
participation
and
governance
that
is
required.
A
We
fulfill
the
security
aspect
of
that
Spectrum,
so
a
project
comes
to
tax
security
and
presents
and
says
this
is
what
we
do
end
to
end
and
gives
the
participants
an
opportunity
to
interrogate
the
maintainers.
Why
did
you
make
this
decision?
How
does
this
fit
with
another
project?
Where
is
your
threat
model
for
these
things?
A
We
then
go
back
to
the
project.
There
is
also
a
self-assessment
role
that
a
project
can
take,
and
then
we
feed
back
into
the
technical
oversight
committee
and
give
guidance
on
how
to
harden
that
project,
ultimately
trying
to
raise
that
bar
of
security
in
the
most
consensus
and
collaborative
driven
way
that
we
know
how.
A
So,
first
of
all,
strengthening
the
ecosystem,
identifying
gaps
in
the
individual
projects-
and
we
say
this
again
from
a
position
of
compassion
security
is
difficult
and
no
one
individual
has
a
real,
full
Transcendent
view
of
all
the
potential
problems.
So
by
organizations
but
sorry
by
projects
submitting
to
the
organization
they
have
the
opportunity
to
gain
various
different
perspectives
from
a
Security
application
or
from
a
low-level
design
and
everything
in
between
and
again.
We
hope
that
this
open
collaboration
style
builds
up
the
quality
of
the
project
in
the
the
most
friendly
and
compassionate
way
possible.
A
We
also
have
a
mandate
for
Education.
Part
of
this
is
we've
just
spent
two
days
running
Cloud
native
security
con.
It
was
a
zero
day
event
that
has
spawned
into
a
minus
one
day,
event
I'm,
always
hesitant
to
say
zero
day,
event
and
security
context,
but
we're
very
proud
to
say
that
that
will
also
birth,
its
own
independent
conference
that
we'll
talk
about
later.
A
But
yes,
we'll
talk
a
little
bit
more
about
that
as
we
progress,
fostering
maturity
again.
Is
this
goal
of
ensuring
that
projects
are
able
to
ascend
through
the
cncf's
graduation
process,
with
the
level
of
technical
rigor,
that
we
would
expect
engaging
more
communities
again
reaching
out
and
ensuring
that
we
perform
a
social
community
and
security
function
and
finally
nurturing
growth
and
participation?
And
this
really
is
one
of
the
key
aspects
of
the
group.
A
With
that
we
move
on
slightly.
We
have
a
charter
that
is
public.
This
is
how
we
engage
with
the
technical
oversight
committee.
Ultimately,
the
point
of
the
group
is
to
try
and
raise
that
bar
of
security
in
again,
a
compassionate
and
collaborative
manner,
helping
developers
to
meet
security
requirements.
A
Most
developers
do
not
enjoy
shipping
security
patches
because,
ultimately,
they're
bugs
not
features
in
many
cases,
so
helping
to
make
those
design
decisions
easier
to
make
earlier
in
the
life
cycle
of
a
project
is
again
foundational
to
what
we
really
care
about,
and
finally,
audit
and
reasoning
about
system
properties.
A
lot
of
tooling
does
not
publish
a
threat
model
or
an
attack
tree
or
a
security
property
Matrix.
One
of
the
things
that
the
group,
one
of
the
excellent
pieces
of
work
that
the
group
has
undertaken,
was
a
threat
model
for
spiffy
spire.
A
This
publishes
details
or
a
detailed
view
on
the
compromised
resistance
of
the
system,
so
spiffy
Spire
as
a
work
field,
identity
and
dynamic
attestation
service
by
understanding
the
model
of
compromise
and
how
those
security
properties
degrade
with
certain
levels
of
adversarial
access.
It
means
people
building
on
top
of
that
system
can
make
again
make
those
design
decisions
about
how
they
integrate
and
Implement
those
tools
far
earlier,
and
it's
that
level
of
democratization
of
security
information
that
we
are
especially
interested
in.
A
One
of
the
real
personal
benefits
for
me
of
working
in
the
group
is
the
opportunity
to
collaborate
with
people
who
excel
in
their
own
specializations
and
their
own
parts
of
the
field.
Really
it's
an
opportunity
to
learn
and
grow
in
public
and
as
much
participation
or
observation
as
the
individual
Fields
is
appropriate,
is
entirely
welcome.
We're
just
looking
to
raise
the
bar
for
everybody.
A
A
Again,
it's
just
an
opportunity
to
spread
as
much
information
and
open
the
floor
as
widely
as
possible
by
demonstrating
the
adversarial
and
attacker
mindset
to
apply
the
minimum
viable
controls.
So
we're
not
looking
to
constrict
maintainers
we're
not
looking
to
apply
an
overly
prescriptive
set
of
security
requirements,
just
the
minimum
controls
to
satisfy
requirements,
ensure
agility
of
the
system
and
make
sure
that
we
have
a
quantifiable
Baseline,
and
we
do
that
by
demonstrating
what
can
go
wrong
very
proud
to
work
with
these
individuals.
A
B
Thank
you,
so
I'll
talk
a
bit
now
about
some
of
the
work
we
do.
Some
of
the
ongoing
and
recently
completed
work
that
we've
done
with
the
tag
so,
first
of
all,
I'm
going
to
announce
some
of
the
the
things
that
the
group
recently
completed
or
recently
finished,
including
a
version
two
of
the
cloud
native
security
white
paper.
This
is
a
white
paper
that
provides
guidance
to
anyone
in
the
cloud
cloud
native
Community
about
security
and
in
all
different
forms.
B
All
different
types
has
a
lot
of
detail
and
the
2.0
really
make
sure
to
modernize
and
include
new
technologies.
New
advice
there's
also
a
supply
chain
security
white
paper
that
kind
of
focuses
specifically
on
supply
chain
security
problems,
because,
as
right
as
we
were,
writing
this,
the
original
security
white
paper,
we
realized
that
this
was.
You
know
its
own
topic
that
needed
a
separate
discussion
and
so
that
white
paper
is
also
available.
B
Now,
in
addition,
there's
a
cloud
native
control
security
controls
catalog,
which
takes
some
of
the
same
recommendations
from
the
security
white
paper,
but
really
breaks
that
breaks
them
down
into
like
individual
pieces
that
you
have
to
get
done
and
with
advice
about
different
tools
and
other
pieces
to
achieve
them
and
also
mappings
to
various
regulations
and
requirements
like
the
ssdf
and
other
groups.
So
you
can
see
how
all
this
different
advice
that
you're
getting
from
all
these
different
places,
really
fits
together
in
a
practical
way.
B
B
Also,
we
have
some
in
progress
and
ongoing
work
highlighted
here.
We
have
some
lightweight
lightweight
threat,
modeling
project
and
all
of
these
projects
here
that
I'll
talk
about
have
links
to
GitHub.
So,
as
Andy
mentioned,
all
of
our
work
goes
through
GitHub.
So
the
easiest
way
to
get
involved
with
anything
that
I'm
talking
about
just
to
go
to
the
issues
linked
on
this
slide,
which
will
be
shared
and
or
talk,
talk
to
the
folks
tagged
in
those
issues
about
how
to
get
involved
so
yeah,
lightweight
threat.
B
Modeling
is
a
project
that
is
designed
to
kind
of
help,
improve
the
security
assessment
project
for
the
the
cncf
and
more
versions
of
that
cloud.
Native
security
white
paper
are
also
ongoing.
The
you
know
the
world
of
security
continues
to
evolve,
and
so
this
white
paper
continues
to
evolve
as
well
to
reflect
all
the
changes
that
are
happening
so
we're
working
on
both
the
written
3.0
version
of
this
white
paper.
B
B
Next
we
have
these
Cloud
native
security
controls
mapping.
So
this
relates
to
that
cloud.
Native
security
controls
catalog.
This
is
mapping
different
tools
in
the
ecosystem
to
those
controls,
so
that
you
you
can
tell
immediately.
These
are
all
you
know
if
you
look
at
the
whole
cncf
landscape,
there's
a
lot
of
tools
available
a
lot
of
security
tools
even
available
on
the
landscape,
so
these
mappings
can
help
you
figure
out
which
of
these
tools
are
actually
designed
to
solve
each
of
the
different
problems
that
we
talk
about
in
security.
B
B
This
is
just
an
ongoing
list
that
keeps
track
of
software
supply
chain
compromises
related
to
Cloud
native
Technologies,
and
so
we
try
and
keep
keep
up
with
different
types
of
attacks,
not
every
attack
that
happens,
but
all
the
different
types
of
attacks
that
happen
so
that
we
can
tell
you
know
what
are
the
emerging
threats
in
this
space.
And
how
can
we
address
those
things
so
yeah
next
I
will
hand
it
off
to
Raga
to
talk
a
bit
about
creating
the
cloud
native,
secure
security,
community.
C
C
So
we
have
a
continuous
effort
to
make
awareness
possible
in
our
community,
and
this
can
be
within
the
cncf
community,
with,
for
example,
like
the
kubernetes
security,
where
in
constant
touch
with
the
team-
and
we
also
collaborate
with
them
for
a
better
understanding
of
the
community
and
hardening
of
the
hardening
of
the
projects
itself
self,
and
this
is
also
a
level
up.
We
also
collaborate
with
the
Linux
foundation
and
its
projects
and
opportunities.
C
Openssf
is
one
of
one
of
such
collaboration
and
we
also
go
beyond
the
Linux
foundations,
for
example
the
CSA,
and
things
like
that.
So
we
are
in
constant
collaboration
with
other
communities
who
are
working
in
a
similar
space
to
provide
you,
the
holistic
view
of
all
the
things
that
you
need
to
be
aware
of
to
make
a
holistic
decision
for
your
project,
and
we
also
provide
a
platform
for
the
projects
to
come.
Talk
to
us.
C
We
are
here
for
you
and
we
are
here
to
listen
and
provide
feedback
for
your
projects
and
really
uncover
all
the
decisions
that
you've
made
about.
So
Andy
mentioned
that
the
spiffy
inspiry
we
help
the
with
the
threat
modeling
and
really
ask
the
tough
questions
on
why.
Why
were
certain
decisions
made?
What
are
the
implications
of
such
decisions
and
how
how
they
are
actually
doing
well
and
where
they
could
potentially
improve?
C
So
these
are
some
of
the
platforms
that
we
provide,
and
this
is
also
another
opportunity
for
the
community
to
learn
about
all
the
different
things
that
is
available
for
them
to
go
back
and
make
use
of
those
projects.
So
it
works
either
ways
and
it's
beneficial
either
ways.
So
these
are
some
of
the
efforts
that
we
are
taking
for
raising
awareness
in
the
community
itself
and
in
Focus
about
the
security
reviews
itself.
So
our
our
tax
Security
will
be
your
pulse
for
any
of
the
security
requirements
in
your
project.
C
We
act
as
a
friendly
phase,
and
we
are
here
to
help
for
anything
that
you
need
with
respect
to
security,
and
we
are
here
to
help
you
either
educate
or
provide
a
platform
for
reaching
out
to
multiple
folks.
So
that
is
our
main
part
of
our
security
pulse
program
and
another
is
the
security
assessment.
Where
any
project
that
is
looking
to
come
incubate
with
the
cncf,
we
work
with
you
for
the
self-assessment
and
we
provide
you.
C
We
help
you
kind
of
create
a
security
MD
file
with
which
kind
of
provides
a
checklist
of
all
the
basic
things
and
basic
hardening
stuff.
That
needs
to
be
done,
so
you
qualify
to
enter
the
cncf
community
and
once
you
do
that
and
you're
looking
to
graduate,
we
also
have
a
joint
review
program,
so
you
can
really
get
deep
into
it
and
make
sure
in
the
overall
security
posture
of
the
project.
C
Where
can
you
help
us
today
at
the
moment,
just
take
a
couple
of
minutes
and
scan
this
QR
code
and
if
you
can
help
us
with
the
supply
chain
security
questions
that
you
have
or
challenges
that
you're
facing
or
if
you
have
any
feedbacks
for
the
team.
This
would
be
a
really
good
place
to
make
a
meaningful
difference
and
a
meaningful
impacts.
So
take
a
couple
of
seconds
scan
this
QR
and
please
fill
out
this
survey.
This
will
be
massively
helpful
for
us.
C
And
if
you
want
to
join
us,
we
really
are
a
very
good
team
and
we
are
very
approaching
and
helping
you
and
we
help
with
mentorship
for
any
of
the
folks
who
are
willing
to
join
us.
If
you
are
really
interested
check
out.
Our
roadmap,
like
I,
keep
saying
GitHub
is
our
single
source
of
trust
and
you
can
find
all
the
previous
work
and
the
future
work
that
we
are
working
towards
in
GitHub,
especially
I've
pasted.
C
One
of
the
links
for
our
roadmap
so
check
it
out
and
whatever
issues
you're
interested
in
just
put
a
interested
comment
there
and
we
will
reach
out
to
you
we'll
provide
you
with
the
needed
support
to
get
started,
and
especially
if
you
are
a
beginner
in
the
space.
Look
for
something
like
good
first
case
or
help
needed,
which
kind
of
really
makes
it
easier
for
all
the
newcomers
to
join
the
community.
C
And
we,
we
are
very
active
on
slack
and
we
have
a
couple
of
communities
in
the
cncf
working
group.
So
join
us
and
we
actively
talk
on
all
the
new
issues
latest
and
greatest
things,
and
the
new
stuff
that
we
are
working
on
is
always
posted
there
and
some
of
those
working
groups
and
the
activities
that
we
are
either
taking
on
or
publishing
is
also
posted
on
Twitter.
C
So
if
you
are
a
Twitter
person,
there
is
a
handle
as
well
that
you
can
follow
and
we
we
collaborate
on
a
weekly
basis
in
APAC,
sorry
emia,
as
well
as
U.S
time
zone
as
Andy
mentioned,
so
you
can
join
either
of
the
time
zones
or
both
of
them
you're
most
welcome.
So
please
join
us
and
we
collaborate
on
weekly
basis.
C
So,
whichever
is
suitable
for
you
and
if,
for
any
reasons
you
are
like
me
and
miss
out
on
some
meetings,
no
worries
there
is
all
our
meetings
are
always
recorded
and
it's
available
as
live
stream
as
well
as
for
later
usage,
so
make
sure
to
check
us
out
and
now
the
most
interesting
part.
So
now
we
are
going
from
co-located
event
to
a
solo
event.
So
please
check
us
out.
We
were
selling
out
each
time
and
we
thought
why
not
make
this
the
best
use
and
spin
up
a
new
conference
out
of
it.
C
So
it's
happening
on
February,
1st
and
2nd
2023
in
Seattle
Washington,
so
the
cfps
are
open
now
come
join
us,
spread
your
knowledge
and
help
the
community
with
that
said,
thank
you
so
much
from
arakun
for
taking
the
time
to
attend
this
talk,
and
here
is
a
cure
for
sharing
the
feedback
with
us.
So
if
you
like
this
talk
or
if
you
find
it
like,
please
feel
free
to
share
the
feedback,
and
that
will
be
useful
for
us.
Thank
you.
D
E
B
Is
that
working
now
yeah?
So
there's
like
you
know,
there's
a
lot
of
different
working
groups
working
on
different
aspects
of
security.
We
definitely
are
working
with
the
open,
ssf
and
I
think
we're
trying
to
coordinate
to
make
sure
that
you
know
no
duplication
of
effort.
Our
focus
is
really
on
the
cloud
native
security
space
I
think
the
the
open
ssf
is
more
generally
open,
source
security
and,
of
course,
there's
overlap,
but
you
know
we.
B
A
Yeah
I
mean,
in
addition
to
what
Marine
said,
there's
also
the
question
of
where
some
of
these
projects
sits.
So,
for
example,
the
CI
scorecard,
maybe
it's
kind
of
the
CD
Foundation
angle,
but
they're
more
orchestrators.
Maybe
it
could
be
in
the
cloud
native
space,
but
actually
there's
it's
a
general
Cloud
tooling.
So
that's
it
for
the
open
ssf.
A
It's
the
same
for
the
Frisco
project,
the
factory
for
repeatable
software
composition,
artifacts
we're
going
to
go
with
nodding,
heads
thank
you
that
was
that
was
birthed
and
had
as
Genesis
in
tag
security,
but
then
actually
moved
across
into
the
other
foundation.
So
we're
very
close
if
the
supply
chain
security
white
paper
best
Testament
to
this.
In
any
way,
the
list
of
recommendations
include,
for
example,
things
like
running
the
scorecard
cosine
and
six
store,
of
course,
which
also
sit
in
in
that
project
under
that
Foundation.