Open and Secure: Lessons Learned in Five Years of TAG Security Assess... Justin Cappos & Andres Vega
Channel: CNCF [Cloud Native Computing Foundation]
Date: 22/11/2023

Don't miss out! Join us at our next Flagship Conference: KubeCon + CloudNativeCon Europe in Paris from March 19-22, 2024. Connect with our current graduated, incubating, and sandbox projects as the community gathers to further the education and advancement of cloud native computing. Learn more at https://kubecon.io

Open and Secure: Lessons Learned in Five Years of TAG Security Assessments - Justin Cappos, NYU & Andres Vega, M42

Security is perhaps the most misunderstood field of computing. In part this is because many properties of it are hard to quantify. TAG Security regularly conducts security assessments to examine the security of CNCF projects. Compared to audits, the assessment is often detached from a specific deployment and the implementation itself. an assessment focuses more on design flaws and whether a software project as a whole is doing the sorts of things that lead to security. This will be an accessible, light, and (hopefully) fun talk. We will delve into the assessment process, the incisiveness of the review, look at prior assessments, and showcase some computer programs. We will share attack matrixes and results from the assessments of different projects and how assessments have influenced project security. Finally, it will help to recruit new participants who are interested in performing assessments.