search

cncf / tag-security

🔐CNCF Security Technical Advisory Group -- secure access, policy control, privacy, auditing, explainability and more!
https://tag-security.cncf.io
Other
2k stars 498 forks source link

Cloud Native Security Whitepaper #138

Closed ultrasaurus closed 3 years ago

ultrasaurus commented 5 years ago

In 2018, SAFE WG focused on understand security, given modern (cloud native) enterprise infra, and synthesized into a common understanding; however, much of what we have learned is buried in meeting notes and presentations.

We would like to now communicate what we’ve understood to the rest of the world. One step will be to draft a SAFE whitepaper that covers over-arching concerns. Some of us met (march 22, 2019) to brainstorm a whitepaper outline:

Outline:

Current Whitepaper Work in progress:

Whitepaper ready for review Comments are turned on so please comment!

TO DO

Proposed Schedule:

Meeting notes for WG syncs

Meeting note and agenda

ultrasaurus commented 5 years ago

@pragashj @dshaw @ultrasaurus, Jessica Walker and Sara Dornsife met to discuss white paper content - see 3/22/2018 meeting notes

ultrasaurus commented 5 years ago

Moved outline into separate doc where we can elaborate into a full whitepaper.

[OUTDATED]NOTE: As of July 2020, we have moved to a new document: Cloud Native Security Whitepaper - @dshaw]

EDIT (@lumjjb): New document is at https://docs.google.com/document/d/1MEeqWvUavXK5TkuFIfoJbtxCT-2FdTw7jgYP3kxtbmk/edit?usp=sharing

rficcaglia commented 5 years ago

just a process question - is it more desirable to use Google Docs vs. markdown docs that can be PR'd? is the idea to minimize git activity until there is a solid draft document rather than have the full "sausage making" process clutter up the git stream?

pragashj commented 5 years ago

That is the idea, please feel free to chime in on the doc and help shape it.

TheFoxAtWork commented 3 years ago

related #405

whaber commented 3 years ago

I would like to participate. Please include me in future discussions on it.

vinayvenkat commented 3 years ago

+1 @vinayvenkat

PushkarJ commented 3 years ago

+1 please include me

tabbysable commented 3 years ago

+1

trishankatdatadog commented 3 years ago

+1

dshaw commented 3 years ago

@vinayvenkat @whaber @PushkarJ @tabbysable @trishankatdatadog I have added you all to the new working group Slack channel.

For any other members of SIG-Security who may want to join us, add yourself here then please also ping me on Slack.

chasemp commented 3 years ago

Please add me at your convenience to the slack channel. Thanks @dshaw.

gadinaor commented 3 years ago

@dshaw - can you add me to the slack channel please

sublimino commented 3 years ago

@dshaw me too please :pray:

TheFoxAtWork commented 3 years ago

@gadinaor - i don't see you in the members listing or in the existing slack to add you

gadinaor commented 3 years ago

@gadinaor - i don't see you in the members listing or in the existing slack to add you

@TheFoxAtWork true // I'm part of it now

IAXES commented 3 years ago

May I please be added as well? Thank you @dshaw

kapilt commented 3 years ago

I'm also interested re slack and discussion on this topic, thanks @dshaw

TheFoxAtWork commented 3 years ago

@kapilt i DM'd u in slack, need ur email to get u access, updates are in the channel

rowan-baker commented 3 years ago

May I please be added to the slack channel, I am looking to help @sublimino with his contribution. Also raising a PR to join as a member shortly. Thanks @dshaw / @TheFoxAtWork

TheFoxAtWork commented 3 years ago

Updated with new schedule to allow more time for content generation

TheFoxAtWork commented 3 years ago

Team is moving forward! extended the collaborative review by a week to accommodate busy schedules

TheFoxAtWork commented 3 years ago

merge https://docs.google.com/document/d/11gyDDsKtMchMlj9ZKDl5LSHNxgu04tq1dTSD1BnTG9o/edit#heading=h.v65lmin9x1eb Issue #20 into the white paper

SaadUSheikh commented 3 years ago

@ultrasaurus please can you add me to Security white paper i want to give some inputs specially for Telecom perspective , thanks

fctoibm commented 3 years ago

Enterprise Core areas of concern for Enterprise to adopt a cloud-native model are maintaining the current process and procedures while meeting the business objective. Keeping the interoperability, data loss or leakage, and security risk exposure at a minimum when new standards and practices are introduced throughout the organization. Microbusiness Small businesses tend to focus on short term goals and innovation to meet intense competition. The lack of resources, budget, technology depth, and best practice hinders their ability to adapt to cloud-native solutions. Small business requires repeatable patterns and small IT footprint to solve the challenges.
Finance Core areas of concern for financial industries essential to successful cloud-native adoption are unauthorized disclosure of information, fraud, and fund availability. Fraud can directly impact fund availability, making the integrity of financial transactions of paramount importance.
Healthcare Core areas of concern for healthcare industries essential to successful cloud-native adoption are unauthorized disclosure of information, timeliness, availability of records, and records accuracy. Due to the nature and practices of the healthcare industry, the availability of records and their associated content is how medical decisions are made. In the absence of such information, new records are developed. Academia and education Core areas of concern for educational institutions for successful cloud-native adoption can depend upon the intended end user. Institutions catering to minors may have additional legal requirements to protect minors’ confidentiality, thereby making access control critical. Beyond this, institutions should focus on the availability of educational content to end-users. Public Sector Core areas of concern for Public Sector organizations to implement cloud-native adoptions are security, data sovereignty, compliances, and vendor lock-in. The barriers emerge from agencies placing regulations to protect the public interest. In the public sector, it is essential to maintain harmony and trust between public and government entities.

lumjjb commented 3 years ago

Thanks Harmeet, i'll add them into the doc

vinayvenkat commented 3 years ago

Sig-Security meeting on 9/16/2020 White paper update: https://docs.google.com/presentation/d/1JVNMxDAJFbTTmmEwpL5lh_OGajbDfZx5E40YRkg1cV0/edit#slide=id.g97edbdf573_0_48

TheFoxAtWork commented 3 years ago

Thanks to everyone who helped make this possible. The Cloud Native Security Whitepaper now lives in the repo as Markdown. As significant changes occur, we will republish the PDF by major version.