Security Technical Advisory Group

Cloud Native Security Logo

Objective

The CNCF Security Technical Advisory Group facilitates collaboration to discover and produce resources that enable secure access, policy control, and safety for operators, administrators, developers, and end-users across the cloud native ecosystem.

Background

Cloud Native describes the building, deploying, and operating of modern applications in cloud computing environments, typically using open source. This complex ecosystem composed of different open source projects presents an increasingly complicated technology risk landscape. While there are several projects in the cloud native ecosystem that address trust, safety, and security in the dynamic interplay between the different layers of infrastructure and application services, the technological shift demands application and information security be rethought through the lens of developer experience as close to applying software engineering to design for security considerations in the effort to safeguard an integrated cloud native ecosystem as a whole.

Vision

We believe in a future where the probability and impact of attacks, breaches, and compromises are significantly reduced. Where the most common risks of today are not just mitigated but made implausible. We believe developers and operators can be empowered to understand better and be reassured by the posture of the systems they build and run through the informed use of cloud technologies with clear understanding of responsibility and risks and the unlocked ability to validate that their architectural intent meets compliance and regulatory objectives.

There is a growing ecosystem of tools that promises to unlock developer productivity and operational efficiency. We strive to fulfill the human side of the sociotechnical equation to acceleration and attain that promise including:

  1. Consumable system security architectures that account for the ever growing heterogeneity of systems and provides a framework to protect resources and data while servicing their users.
  2. Common lexicon and open source libraries that make it easy for developers to create and deploy apps that meet system security requirements.
  3. Common libraries and protocols that enable people to reason about the security of the system, such as auditing and explainability features.

Publications

TAG Security has published several resources for the community, which can be found in the publications document.

Governance

Security TAG charter outlines the scope of our group activities, as part of our governance process which details how we work.

Communications

Anyone is welcome to join our open discussions of Security TAG projects and share news related to the group’s mission and charter. Much of the work of the group happens outside of Security TAG meetings and we encourage project teams to share progress updates or post questions in these channels:

Group communication:

Leadership:

Slack governance

Refer to the slack governance document for details on slack channels and posting to the channels.

Meeting times

For our members in North and South America, we host weekly sessions each Wednesday at 10 am (UTC-7). To participate, simply use the following Zoom link: https://zoom.us/j/99809474566. The meeting ID is 998 0947 4566.

Meanwhile, participants from Europe, the Middle East, and Africa (EMEA) can join bi-weekly meetings on Wednesdays at 1 pm UTC+0, which adjusts to UTC+1 when daylight saving time is in effect. Join us through this Zoom link: https://zoom.us/j/99917523142, with the meeting ID: 999 1752 3142.

To find the corresponding time in your local area, please see your timezone here.

This dual schedule ensures that no matter where you are, you’ll have a place in our conversations.

We invite you to mark your calendars and join the dialogue. For your convenience, all meetings are listed on the main CNCF calendar as well as the TAG Security Calendar. These calendars are updated regularly to ensure that you stay informed of all upcoming meetings and events.

Got something to bring up or share? Review how to get a topic or presentation added to the Agenda on our process page.

Gatherings

Please let us know if you are going and if you are interested in attending (or helping to organize!) a gathering. Create a github issue for an event and add to list below:

Past events

New members

If you are new to the group, we encourage you to check out our New Members Page

There are several groups that are affiliated to or do work and cover topics relevant to the work of Security TAG. These can be seen here

History

Members

Security TAG Chairs

  • Pushkar Joglekar ( @PushkarJ), Independent [Chair term: 6/3/2023 - 6/3/2025]
  • Marina Moore ( @mnm678), NYU [Chair term: 10/3/2023 - 10/3/2025]
  • Eddie Knight ( @eddie-knight), Sonatype [Chair term: 5/6/2024 - 5/6/2026]

Tech Leads

Security TAG Chair Emeriti

  • Dan Shaw ( @dshaw), PayPal [Chair term: 6/3/2019 - 9/3/2020]
  • Sarah Allen ( @ultrasaurus), [Chair term: 6/3/2019 - 6/3/2021]
  • Jeyappragash JJ ( @pragashj), Tetrate.io [Chair term: 6/3/2019 - 6/3/2021]
  • Emily Fox ( @TheFoxAtWork), Apple [Chair term: 9/28/2020 - 2/4/2022]
  • Brandon Lum ( @lumjjb), Google [Chair term: 6/3/2021 - 6/3/2023]
  • Aradhana Chetal ( @achetal01), TIAA [Chair term: 6/3/2021 - 9/3/2023]
  • Andrew Martin ( @sublimino), ControlPlane [Chair term: 3/17/2022 - 3/17/2024]

On-going projects

Compliance Working Group

Compliance Working Group is cross-disciplinary and focused on bridging purely technical issues to broader legal and regulatory workflows: not only the prevention of system breaches, but also considering supply chain, operators, data and AI failures while simultaneously considering auditability, non-repudiation, legally required forensic evidence, etc. - across all the various activities required of cloud native operators of all sizes. The Compliance WG plans to curate vendor neutral tools for evidence collection, chain-of-custody in audits, as well as automated workflows for continuous compliance authoring and assessment.

Weekly meetings at 10:00 AM ET (60 min) Check My Time

See CNCF calendar for invite.

Meeting link: Zoom meeting

Meeting notes link

Security reviews

Security reviews are a collaborative process for the benefit of cloud native projects and prospective users by creating a consistent overview of the project and its risk profile.

Facilitator: Justin Cappos ( @JustinCappos), New York University

Co-chair representatives: @PushkarJ @eddie-knight

Software Supply Chain Security

Software Supply Chain attacks have come to the wider community’s attention following recent high-profile attack, but have been an ongoing threat for a long time. With the ever growing importance of free and open source software, software supply chain security is crucial, particularly in cloud native environments where everything is software-defined.

Weekly meetings at 8:00 AM PT (50 min) (see your timezone here) See CNCF calendar for invite.

Facilitator for current deliverables is listed on the issue

Additional information

CNCF Security TAG reviews

As part of the CNCF project proposal process projects should create a new security review issue with a self-assessment .

Past events and meetings

For more details on past events and meetings, please see our past events page