Cloud Native
Security Talks RSS

KubeCon North America 2021

Kubernetes Supply Chain Security: The Software Factory

Andrew Martin, Control Plane

Abstract

The original supply chain attack was described by Ken Thompson 35 years ago, in Reflections on Trusting Trust. As the SUNBURST attacks abuse the same implicit trust relationship between consumers and vendors today, we ask ourselves: does cloud native have the answer? Based on work from the US Air Force and DoD, we present a Kubernetes Software Factory approach that can defend against supply chain risks. But can we mitigate the risk entirely? What about consuming closed source and binary artefacts? Is there a silver bullet for this producer-consumer problem, that impacts supply chain relationships at all levels of industry and technology? In this talk we: - Showcase work to build a Kubernetes Software Factory with Tekton - Deep dive on signing and verification approaches to securely build software with in-toto, TUF, SPIFFE, SPIRE, and sigstore - Review lessons learned from the SUNBURST attacks - Detail future cloud native solutions to harden Kubernetes, builds, and infrastructure

More from KubeCon North America 2021

Open in the index →
  1. sigstore: How We Started, Where We Are, Where We are HeadedBob Callaway, Red Hat & Dan Lorenc, Google 2021-10-13
  2. My Container Image has 500 Vulnerabilities, Now What?Matt Jarvis, Snyk 2021-10-13
  3. Kubernetes Exposed! Seven of Nine Hidden Secrets That Will Give You PauseIan Coldwater, Twilio & Brad Geesaman, Aqua Security 2021-10-13
  4. Exploiting a Slightly Peculiar Volume Configuration with SIG-HonkIan Coldwater, Twilio; Brad Geesaman & Rory McCune, Aqua Security; Duffie Cooley, Isovalent 2021-10-13
  5. Untangling the Multi-Cloud Identity and Access Problem With SPIFFE TornjakBrandon Lum & Mariusz Sabath, IBM 2021-10-14
  6. Know Your Enemy: Mapping Security Risks Using Threat Matrix for KubernetesYossi Weizman & Ram Pliskin, Microsoft 2021-10-14
  7. Keeping Up with the CVEs: How to Find a Needle in a Haystack?Pushkar Joglekar, VMware 2021-10-14
  8. Insights into Unsecured Kubernetes in the WildJay Chen & Aviv Sasson, Palo Alto Networks 2021-10-14
  9. Fine-Grained User Authorization for Kubernetes with OPA and LDAPCagri Cetin & Quentin Long, Yelp Inc. 2021-10-14
  10. We Built the Kubernetes SBOM and Now You Can Write Your Own!Adolfo García Veytia, uServers 2021-10-15
  11. The Hitchhiker's Guide to Kubernetes VulnerabilitiesRobert Clark & Micah Hausler, Amazon 2021-10-15
  12. Everything Wrong with K8s Authentication and How We Worked Around ItMo Khan & Margo Crawford, VMware 2021-10-15
  13. Bridging the Great Divide: SPIFFE/SPIRE for Cross-Cluster AuthenticationAndrew Harding, VMware 2021-10-15