Cloud Native
Security Talks RSS

KubeCon Europe 2019

Inside the CNCF Project Security Reviews

Justin Cormack, Docker

Abstract

Last year the CNCF started funding security reviews for its projects. This talk examines the review process from the inside and looks at the outcomes and lessons from the reviews that have been performed so far. What vulnerabilities were found? What types of problem are common across projects? How should you prepare for a review? The talk will cover how to make the most of a security review, what to expect from it, what to bring to the review process, and how to maximise the benefits of a review. It will be illustrated with details of the review process for the Notary and TUF audits from the inside as I was involved in this process, and with a detailed analysis of the public reports, including Prometheus, CoreDNS, Envoy, Containerd and more. The talk will look at the issues found in the different projects, the areas in which issues were not found, and common themes.

More from KubeCon Europe 2019

Open in the index →
  1. Using eBPF to Bring Kubernetes-Aware Security to the Linux KernelDan Wendlandt, Isovalent 2019-05-21
  2. Portable, Universal Single Sign-On for Your ClustersMiguel Martinez, Bitnami 2019-05-21
  3. Kubernetes + Encrypted Memory = Security * PrivacyHarshal Patil & Pradipta Banerjee, IBM 2019-05-21
  4. Fine-Grained Permissions in Kubernetes: What’s Missing, and How to Fix ThatVallery Lancey, Lyft & Seth McCombs, Triller 2019-05-21
  5. Envoy SDS: Fortifying Istio SecurityYonggang Liu & Quanjie Lin, Google 2019-05-21
  6. Zero Trust Service Mesh with Calico, SPIRE, and EnvoyShaun Crampton, Tigera & Evan Gilman, Scytale 2019-05-22
  7. Smarter Kubernetes Access Control: A Simpler Approach to AuthRob Scott, ReactiveOps 2019-05-22
  8. Crafty Requests: Deep Dive Into Kubernetes CVE-2018-1002105Ian Coldwater, Heroku 2019-05-22
  9. Container Forensics: What to Do When Your Cluster is a ClusterMaya Kaczorowski & Ann Wallace, Google 2019-05-22
  10. Caller ID in KubernetesMichael Danese, Google 2019-05-22
  11. Uber x Security: Why and How We Built Our Workload Identity PlatformTyler Julian, Uber & Daniel Feldman, Scytale 2019-05-23
  12. Securing Multi-Cloud Cross-Cluster Communication with SPIFFE and SPIREEvan Gilman, Scytale, Inc. 2019-05-23
  13. Securing Kubernetes with Trusted Platform Module (TPM)Alex Tcherniakhovski & Andrew Lytvynov, Google 2019-05-23
  14. Secrets Store CSI Driver-Bring Your Own Enterprise Secrets Store to K8sRita Zhang, Microsoft & Anubhav Mishra, HashiCorp 2019-05-23
  15. Protecting the Data LakeAsh Narkar, Styra, Inc 2019-05-23
  16. DIY Pen-Testing for Your Kubernetes ClusterLiz Rice, Aqua Security 2019-05-23