Cloud Native Security Talks

SB💣💣M: Making SBOMs Play Together - Jacopo Bufalino, CNAM & Agathe Blaise, Thales SIX GTS France

2026-03-26T00:00:00+00:00

The Cyber Resilience Act (CRA) is transforming how we approach software security, demanding not only safer code but proof that it remains secure throughout its lifecycle. At the core of this is the SBOM– a transparent inventory of all components inside an application, built to reveal hidden dependencies and vulnerabilities. A growing ecosystem of open-source and cloud-based tools promises to generate these SBOMs and automatically map vulnerabilities. Yet in practice, these tools often produce conflicting results, inconsistent package lists, and mismatched vulnerability reports, especially when scanning complex container images. In this talk, we dissect why SBOMs and vulnerability reports diverge across tools, uncover the technical roots of these discrepancies in containerized environments, and discuss how developers can ensure their tooling remains CRA-compliant. Finally, we explore how the ecosystem must evolve to deliver a transparent, trustworthy, and secure software supply chain.

SPIFFE Meets OAuth: Federated Identity for Cloud Native Workloads - Yoshiyuki Tabata, Hitachi, Ltd.

2026-03-26T00:00:00+00:00

Cloud-native systems increasingly operate across multiple trust domains, creating significant challenges for securely propagating identity and authorization. Traditional approaches, such as static credentials or mTLS-only solutions, often introduce operational complexity and fail to scale in dynamic Kubernetes environments. This session addresses these challenges by introducing federated identity patterns that combine SPIFFE and emerging OAuth extensions. Yoshiyuki Tabata will demonstrate how SPIFFE JWT SVID and OAuth Identity Chaining (draft-ietf-oauth-identity-chaining), together with Assertion Framework (RFC 7521/7523), enable secure multi-hop authorization and scalable identity propagation without relying solely on mTLS. Attendees will gain practical insights through a demo integrating Keycloak, SPIRE, and OAuth flows, and learn how these patterns improve interoperability and security in multi-cluster Kubernetes environments.

Tailor Made: Dynamic Fine-Grained Authorization for API Traffic - Erica Hughberg, Tetrate & Andres Aguiar, Okta

2026-03-26T00:00:00+00:00

Modern API access control requires authorization models that can adapt to real-time conditions and complex relationships. Learn how to move beyond static authorization methods that are complex to revoke, like API keys and tokens, and improve your security posture with dynamic access decisions.We’ll demonstrate how to implement fine-grained authorization at the gateway level by integrating OpenFGA with Envoy Gateway in Kubernetes, enabling context-aware access decisions at the edge of your system. With live demonstrations, we’ll showcase how OpenFGA’s Relationship-based Access Control (ReBAC) model can solve complex authorization challenges. For example, has your boss approved you to access confidential information about Project X?We’ll present three entertaining yet practical examples that showcase common multi-tenant SaaS challenges, B2B API access, and data-dependent authorization rules.

The Shared Service Blueprint: A Guide to Multi-Tenancy, Illustrated With KEDA - Aya Igarashi, Preferred Networks, Inc.

2026-03-26T00:00:00+00:00

What should you consider when providing a service in a multi-tenant Kubernetes environment? How can you maintain strong tenant isolation when the tools weren’t originally designed for it?In this session, we share practical lessons and key considerations from our journey, using the event-driven autoscaler KEDA as a concrete case study. Key topics include:- Architectural trade-offs and secure design principles for multi-tenant components- NetworkPolicy patterns for strict network boundaries- Kubernetes APIService limitations and solutions for multi-tenancy- AuthN/AuthZ mechanisms for a Kubernetes External API ServerBy the end, you’ll gain actionable insights to architect secure, multi-tenant services, along with a deep understanding of crucial Kubernetes extension mechanisms.

Audit-Ready Kubernetes: How Chase UK Leveraged Policy as Code for Continuous Compliance - Jim Bugwadia, Nirmata & Nischay Goyal, JP Morgan Chase

2026-03-25T00:00:00+00:00

Building a foundational cloud platform in a regulated financial environment is a massive undertaking. This session dives into how a Chase UK’s Cloud Platform team leveraged CNCF and open source tools like Kyverno, OpenReports, and Grafana to enable backend engineers to build services safely at speed by enforcing real-time compliance and governance with Policy as Code. Facing stringent regulatory needs, the bank’s platform team evaluated solutions and selected Kyverno as a unified policy and governance solution driving a critical shift-left security strategy. Today, this solution is deployed in production, enabling the security team to independently write policies. Crucially, the solution cut compliance audit times dramatically, from weeks to minutes, automating complex requirements at scale. This session will detail the team’s journey, lessons learned, and scaling plans and is Ideal for platform teams in regulated industries or anyone running critical workloads on Kubernetes.

Automate Once, Run Anywhere: The Docker Moment for Security Workflows - Nancy Chauhan & Aseem Shrey, ShipSecAI

2026-03-25T00:00:00+00:00

Most security automations are fragile and tied to a single environment, once you leave a team, they break or vanish. In this talk, we explore how to make security automation portable, reproducible, and Kubernetes-native. Using open, declarative workflow definitions, we built a model where each automation runs as a containerized workload with custom resource specs, security policies, and observability baked in. The result? Automations that can be deployed on any cluster, across teams or organizations, without rewriting code or losing visibility just like containers revolutionized application delivery, this approach aims to do the same for security workflows.

Automating and Scaling of Threat Modelling for Cloud Native Architecture - Hanna Papirna & Emma Yuan Fang, EPAM Systems

2026-03-25T00:00:00+00:00

Security teams often struggle to threat model cloud-native applications running on Kubernetes in cross-tenant environments. Traditional methods cannot keep pace with microservices, containers, serverless deployments and continuous delivery cycles. This session presents a block-based methodology that divides applications into four clear domains: gateway, service mesh, identity management, and storage. The approach makes threat analysis scalable and integrates seamlessly into development workflows. Attendees will also learn to adopt threat modelling as code with declarative models validated in CI/CD pipelines. A demo illustrates how to use AI tools optimally to reveal security risks in complex microservices applications and highlights how CNCF-graduated project controls address many threats while exposing remaining gaps. Attendees will leave with a repeatable workflow for threat modelling applicable to Kubernetes, serverless, or hybrid cloud-native systems.

Bob and Alice Revisited: Understanding Encryption in Kubernetes - Jackie Maertens & Mitch Connors, Microsoft

2026-03-25T00:00:00+00:00

Encryption is a fundamental aspect of securing data, yet many Kubernetes users struggle to differentiate between various encryption methods such as symmetric, asymmetric, TLS, mTLS, and VPN. This talk aims to demystify these concepts using the classic fictional characters Bob and Alice, who have been used to explain encryption since the 1970s. We will revisit their story and adapt it to the modern Kubernetes ecosystem, providing clear explanations and practical examples. These examples will demonstrate encryption in Kubernetes use cases such as ingress, API server communication, SPIFFE and service mesh traffic with projects like Istio. We will also explore trade-offs between data security and usability - helping you answer the age-old question: how much encryption is enough? Attendees will leave with a solid understanding of encryption techniques and how to apply them effectively in their Kubernetes environments.

Detect, Decide, Defend: Building Cloud Native Security That Fights Back - Matthias Bertschy, ARMO

2026-03-25T00:00:00+00:00

Let’s face it: most Kubernetes security tools surface alerts- but don’t help teams act. Incidents trigger noisy dashboards and virtual war rooms, with engineers stitching logs and manifests, unsure what’s safe to fix. Cloud Application Detection and Response (CADR) introduces a new approach: combining real-time detection with automated remediation to create a full lifecycle for runtime security. By correlating posture, configuration, and runtime behavior, CADR delivers high-confidence alerts with actionable context. RemOps then translates those signals into safe, automated responses using Kubernetes-native APIs and declared manifests. In this session, you’ll learn how CADR detects threats by analyzing manifests, metrics, and network policies, and how RemOps closes the loop, without manual toil. Real-world demos will show how to auto-rollback config drift, mitigate privilege escalation, and reconcile live and desired state using fully native Kubernetes constructs.

Exploring NRI for Automated CA Trust Injection - Tsuzuki Tsuchiya & Kento Kubo, LY Corporation

2026-03-25T00:00:00+00:00

Large organizations use private CAs, but public container images lack their certificates. Today, fixing this means operators must manually build new images, or use Init Containers. However, manually installing these CAs in thousands of containers is complex and unreliable. In addition, many OS and programming languages often installs certificates differently. We will demonstrate a novel approach using the Node Resource Interface (NRI) to automatically inject private CA certificates into every relevant container upon startup. This eliminates per-pod customization, enforces organization-wide trust policies, and streamlines operations for secure, large-scale Kubernetes deployments without modifying base images. Attendees will learn how NRI can solve real-world security and operations challenges and we’ll explore the potential of NRI as the new extension point for automating tasks.