SECURITY HUB UNCONFERENCE: STRIDE threat model for the vSphere CSI Driver
Channel: CNCF [Cloud Native Computing Foundation]
Date: 2023-11-22

Don't miss out! Join us at our next Flagship Conference: KubeCon + CloudNativeCon Europe in Paris from March 19-22, 2024. Connect with our current graduated, incubating, and sandbox projects as the community gathers to further the education and advancement of cloud native computing. Learn more at https://kubecon.io

SECURITY HUB UNCONFERENCE: STRIDE threat model for the vSphere CSI Driver

Description: Let's kick off the vSphere CSI Driver threat model together!
Benefits to Ecosystem: Why is this talk or discussion important to cloud native security?
Security is paramount to everything we do. The Self Assessments subproject in SIG Security is currently working on a threat model for the vSphere CSI driver. Currently, we have all the sequence diagrams in place, and now need to begin the STRIDE model itself!
In addition to kicking off this specific threat model, we want to build a security culture in the upstream community. As such, part of the intent with this session is to gather together people who are interested in these efforts as we continue threat models for other parts of Kubernetes.
While it would be great to make a start on the exercise itself, just getting people together for follow-on sessions over Zoom is great too. A good goal for us to have is to submit a talk for Kubecon EU in the Spring.
Additional info:

    Reference to supporting material

Here are our sequence diagrams:
https://app.excalidraw.com/l/9S6CWzRu7GT/2ZxWPy93XiV
Format/process we will use for building the threat model:
https://owasp.org/www-community/Threat_Modeling_Process

________________________________________________________

CNCF STAG (Security Technical Advisory Group) leads will be available to answer your cloud native security questions. Message the @tag-security-leads handle anywhere on CNCF Slack, and we will set up a time to chat in-person.

The Security Hub Unconference is a dedicated space for attendees to learn, share, and collaborate about the latest security practices and tools in the Kubernetes and cloud-native ecosystem. Discover a range of security-related topics, from securing software supply chains to implementing zero-trust security, managing security for cloud-native infrastructure and applications, or building a security-first culture