►
From YouTube: CNCF Security TAG Regular Meeting 2021-08-25
Description
CNCF Security TAG Regular Meeting 2021-08-25
B
B
A
B
A
Up
the
notes
back
in
the
chat
again
for
those
of
you
that
are
just
joining
us
going
to
wait
about
two
more
minutes
before
we
get
started,
I
will
paste
them
again
if
you
could
click
the
link
in
the
chat,
go
ahead
and
add
yourself
to
the
attendance
be
sure
to
put
your
company.
If
you
have
one
your,
if
you
were
on
any
projects
or
or
working
groups
updates,
and
any
updates
that
you
may
have
for
projects
that
are
ongoing
within
the
stag.
We'll
do
a
round
robin
of
quick
project
updates
for
what's
going
on.
A
All
right,
let's
go
ahead
and
get
started
hello.
Everyone
just
a
reminder
that
this
meeting
is
being
recorded
and
posted
to
youtube
shortly
thereafter.
Your
participation
in
these
meetings
is
an
agreement
to
abide
by
the
cloud
native
security
code
of
conduct
which
can
be
found
in
the
repo.
If
I
could
have
someone
volunteer
for
scribe.
Thank
you
rory.
I
really
appreciate
that
for
existing
members
and
working
group
reps,
please
remember
to
include
your
organization
company,
along
with
working
group
that
you're
involved
with,
and
you
have
an
update
on
that.
A
C
Yeah,
I
guess
I
could
give
a
quick
update
on
that,
so
we've
started
with
the
the
set
of
authors,
or
so
the
set
of
authors,
who
can
actually
dedicate
a
reasonable
amount
of
time
to
it.
They've
been
introducing
a
whole
lot
of
content
into
the
into
the
dock,
and
I
will
bring
it
up
and
link
it
in
chat.
I
don't
know
you
might
need
to
request
access
to
it
because
I
think
we're
trying
to
just
keep
it.
C
D
D
So,
of
course,
if
you
want
to
join
the
effort,
now's
a
great
time
to
join
the
effort,
I
we
had
a
leads
meeting
yesterday
afternoon
to
kind
of
figure
out
how
we're
gonna
try
to
unblock
the
effort
and
sort
of
figure
out.
What
is
a
new
set
of
reasonable
timelines
to
get
the
paper
to
review,
which
you
know
continues
to
be
a
bit
of
a
moving
target
sort
of
due
to
the
lack
of
participation.
E
Yeah,
thank
you,
andrew
for
providing
the
update
family.
We
got
together
last
night
and
we
discussed
timelines
we'll
have
to
shift
to
the
right,
but
partially
because
of
cubecon
and
all
the
other
conferences
coming
up
and
participation
being
low
in
the
united
states,
we're
trying
to
readjust
the
timing
of
the
meeting,
so
we
can
find
more
contributors
who
can
participate.
E
With
that
said,
there's
been
some
progress
made
on
the
paper.
There
are
some
we
put
together
a
table
of
contents
and
then
now
several
sections
have
been
filled
out.
We
just
need
to
review
and
start
commenting
on
the
content.
That
is
there
because
different
people
have
different
understanding,
and
so
we
want
to
make
sure
generally.
We
are
in
agreement
with
the
content
and
that's
that's
pretty
much.
The
update
on
several
s.
F
Sure
so
554
I'm
going
to
share
a
screen
out
for
a
second
I'll
put
the
link
to
this
comment
in
the
chat
so
where
we
are
right
now
we
we
got
to
write
in
on
this
over
the
last
week
or
two,
this
sort
of
thoughts
we're
seeing
on
the
screen
right
now
what
I've
been
putting
together.
I
think
we're
at
a
point
where
we're
sort
of
ready
to
close
this
bad
boy
out,
but
we'd
love
to
get
input
back
from.
F
You
know
the
community
in
the
tag
about
how
can
we
sort
of
how
can
we
sort
of
improve
what
we're
doing
here
and
I
think
really,
if
I
sort
of
go
down
and
if
you
want
to
read
the
learning,
it's
probably
too
small,
to
read
on
the
screen
I'll
talk
through
the
highlights
bless
you.
But
what
we're
seeing
is
probably
two
things
we
need
to.
It
seems
like
there's
value,
there's,
definitely
value
in
what
we're
doing
right,
the
the
the
projects
out
there
when
we
first
engage
with
them.
They
love
it.
F
So
I
think
it
comes
down
to
sort
of
having,
as
as
we
can
figure
out.
How
do
we
make
that?
I
don't
use
word
process.
I
want
to
be
a
little
more
pally
and
friendly,
but
the
same
time.
What
we're
seeing
is
we
lay
out
sort
of
a
timeline
of
you
know
week,
one
week
three
week:
five,
these
are
sort
of
things
we're
expecting.
We
want
to
help
you
with,
but
do
it
on
a
timeline
that
seems
to
be
really
of
value
as
we
originally
were
thinking.
F
This
would
be
a
week
or
two
it
ended
up
being
I
don't
know
what
a
month
or
two,
and
I
think,
that's
sort
of,
because
that
we
lost
some
people,
so
I
think,
if
we
sort
of
tell
people
both
on
our
side
and
their
side
up
front,
how
long
this
actually
going
to
be,
and
then
additionally
sort
of
figure
out
how
to
time
box
that
that'll
probably
help
and
then
the
last
thought
I
had
from
it.
I
love
the
idea
of
a
pal
right.
F
I
love
the
idea
of
you
know
it's
a
single
person
going
out
we're
going
to
you
know
it's
personable
we're
going
to
help
that
project,
we're
going
to
figure
out
as
a
security
person.
What
what
they
need
and
what
they
need
help
with,
but
that
becomes
a
single
point
of
failure
on
our
side.
So
is
there
benefit
or
how
do
we
sort
of
have
like
a
pool
people
would
sort
of
loop
through
and
sort
of
one
person's
be
someone
else
can
reach
out
to
them,
and
how
would
that?
E
Yeah,
so
we
had
a
meeting
yesterday
and
it
seemed
like
we
need
to
have
a
discussion
on
scope
of
that
project
and
what
we
are
going
to
cover
because
generic
security
controls
you
can
find
in
all
frameworks
right.
How
do
they
apply
to
cloud
native
platforms?
And
then
are
we
addressing
you
know
infrastructure
as
a
service
bare
metal?
You
know
a
container
as
a
service
or
function
as
a
service.
E
The
following
following
meeting,
which
is
next
week,
we'll
have
a
discussion
on
scope
and
then
start
delineating
how
we
split
up
the
existing
controls
and
map
them
to
the
details,
because
at
a
higher
level,
these
controls
are
not
so
useful.
Unfortunately,
because
data
address
encryption,
everybody
knows
we
need
to
do
that,
but
how
does
that
apply
to
a
cloud
native
platform
and
which
layer
right
so
that
that
is
the
discussion
we
had,
but
yeah
still
forming
and
norming?
I
think
over
time
we'll
evolve.
A
A
All
right,
those
are
all
the
project,
groups
and
working
groups
that
I
have
on
our
regularly
scheduled
meeting
so
now
regular
stand
up
from
folks.
I
have
one
update
cloud
native
security.
Con
schedule
has
been
posted,
so
if
you
were
holding
back
on
your
registration
because
you
weren't
sure
what
the
content
was
going
to
be,
it
is
now
available
for
you.
So
please
jump
in
get
registered
for
either
in
person
or
virtual.
Please
pay
attention
to
the
in-person
requirements
and
we
hope
to
see
you
there
either
online
or
in
person.
B
B
So
I
just
wanted
to
give
a
heads
up
that
some
people
from
there
may
reach
out
to
some
of
you
in
the
near
future
and
if
you
give
them
some
some
attention,
I
would
greatly
appreciate
it,
and
I
also
instructed
them
to
put
together
a
short
presentation
around
10
minutes
and
to
to
submit
it
for
for
here
where
you
can
see
what
kind
of
things
that
they're
they're
doing.
So
I
just
want
to
give
you
all
the
heads
up.
G
Basically,
when
we
did
a
retrospective
and
review
of
the
survey,
one
of
the
feedback
was,
we
want
everything
to
be
secure
by
default
from
the
respondents
and
then
that
led
to
a
very
nice
and
useful
debate
from
all
of
us
about
what
secure
default
means.
How
can
it
be
applied?
What
are
the
problems
in
applying
it
sometimes,
which
meant
like
it
might
be
worth
breaking
out
on
that
topic
and
share
our
point
of
view
to
the
community
and
everyone
else
about
what
it
means
for
us.
It
could
be
potentially
a
blog
post.
G
It
could
be
maybe
a
webinar.
It
could
also
trickle
down
into
the
whitepaper
version
too,
but
we
need
an
owner
for
that
for
it.
So
what
I'm
asking
for
from
everyone
is,
if
you
feel,
really
passionate
about
it
and
have
something
to
share
and
want
to
drive
that
there
is
an
open
issue
where
we
can
basically
mold
it.
The
way
you
want
it
to,
and
just
oh
pick
up
that
issue
and
if,
if
anything,
I
can
do
to
help
review,
write
it
or
make
it
part
of
the
white
paper
or
set
up
webinars.
A
Thanks
pushkar,
so
we've
talked
about
this
in
the
past
during
one
of
our
sessions,
and
I
wanted
to
bring
it
up
yet
again,
because
I
think
this
is
something
that's
important
and
the
end
user
community
is
specifically
requesting
this
as
a
potential
area
for
us
to
provide
real
value
to
them,
and
we
want
to
be
able
to
act
upon
the
feedback
that
we're
receiving
from
the
surveys
make
sure
that
folks
know
that
we're
paying
attention
there's
a
few
different
avenues
that
we
could
go
about
doing
this.
We
can
start
with
something.
A
That's
very
small
scale,
potentially
choose
a
project.
That's
currently
up
for
graduation
and
work
with
them
to
kind
of
identify,
a
secure
configuration
for
that
project,
or
maybe
even
look
at
it,
working
with
them
to
establish
some
secure,
defaults
or
at
least
security
specific
documentation
about
that
particular
project.
So
there's
a
bunch
of
different
ways.
We
could
do
this
as
far
said,
there's
blogs
that
we
could
write.
A
G
I
I
like
that
idea.
A
lot,
maybe
hope,
I'm
not
putting
you
on
the
spot,
john,
but
would
security
pals
be
able
to
find
maybe
a
potential
project.
That's
around
that
phase,
where
they're
thinking
of
graduation
and
kind
of
we
jump
in
and
say,
hey
we've
been
also
getting
this
feedback.
Is
this
something
you
would
want
to
consider
as
part
of
your
graduation
process.
F
G
H
I
think
I
think
talking
to
projects
before
graduation
is
good,
but
actually
one.
It
is
one
of
the
things
that
is
good
to
fix
in
a
project
early
because
it
defines
how
how
people
expect
to
consume
projects
and
how
on
what
users
have
to
do
and
and
those
kinds
of
things.
So
it's
actually.
It
is
something
that's
helpful
early.
I
know
that
it's,
it's
often
quite
difficult.
People
find
it
difficult
to
change
insecure
defaults
later
on,
because
they
it's
like
well
everyone's
used
to
it
being
like
this.
H
A
So
I
wanted
to
kind
of
focus
on
this
today.
This
is
the
only
specific
topic
agenda
that
I
had
besides
security
pals,
because
I
wanted
to
get
folks
thinking
about
it.
How
could
we
potentially
start
small
with
this
build
momentum,
be
able
to
demonstrate
value
back
to
the
end
user
community
and
then
continue
to
kind
of
drive
this
across
multiple
other
projects.
H
Yes,
one
option
might
be:
if
we
could
can
we
come
up
with
anything
around
just
principles
for
security
faults,
so
you
know
if
you're
doing
communications,
you
should
always
be
using
encryption.
It's
a
fairly
basic
one,
but
just
having
those
and
saying
well,
here's
some
basic
high-level,
secure
defaults
that
you
could
we
could
give
to
projects
early
on,
and
so
here's
areas
you
should
be
thinking
about
without
having
to
like
super
drill
into
while
they're
still
working
on
it.
I
G
There
won't
be
a
single
project
that
does
everything,
but
there
may
be
projects
that
do
two
three
things
in
those
set
of
principles,
which
would
be
a
good
thing
for
people
to
refer
to
saying.
Yes,
there
is
state
of
previous
state
of
art,
and
this
is
not
something
that
everyone
is
going
to
start
doing.
Suddenly.
G
I
Yeah
I
write
patterns
all
day.
I
like
capital,
one
used
to
love
to
write
them
a
pattern
right
all
the
time
so
yeah.
I
I
and
I
also
have
principal
statements
and
patterns
on
my
blog,
so
I'm
kind
of
used
to
writing
those
so
but
with
somebody,
because
I'm
not
I've
been
kind
of
in
and
out
of
the
cncf
security
group
because
of
job
changes
and
stuff.
So.
A
Awesome
that
that's
been
great
discussion,
so
that
issue
is
7
34
in
the
repo
for
folks
that
are
interested
or
would
just
want
to
watch
the
discussion
go
ahead
and
comment
on
the
issue.
I
see
this
is
kind
of
like
a
larger
overlap,
effort
or
the
natural
next
progression
of
the
security
pals
work,
as
well
as
the
most
recent
updates
to
our
security
review
process
and
see
how
we
can
get
projects
to
be
a
little
bit
more
active
john.
You
had
something.
F
I
E
G
I
F
G
I
I
wonder
if
there
is
a
template
for
cncf
projects,
that
for
when
you
create
a
repo
for
it,
where
we
can
add
a
markdown
saying
these
are
the
secure
by
default
principles
coming
from
tag
security,
and
it
is
something
you
could
follow.
That
might
be
a
clear
natural
way
of
maybe
sharing
without
a
lot
of
bandwidth
consumed
from
the
group.