Skip to content

🔐CNCF Security Technical Advisory Group -- secure access, policy control, privacy, auditing, explainability and more!

License

Unknown and 2 other licenses found

Licenses found

Unknown
LICENSE.md
Apache-2.0
LICENSE-code
CC-BY-4.0
LICENSE-document
Notifications You must be signed in to change notification settings

tinkerbell/tag-security

 
 

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 

CNCF Security Technical Advisory Group

Cloud Native Security logo

Quick links

Objective

STAG facilitates collaboration to discover and produce resources that enable secure access, policy control, and safety for operators, administrators, developers, and end-users across the cloud native ecosystem.

Background

“Cloud Native” is open source cloud computing for applications — a complete trusted toolkit for modern architectures. There are multiple projects which address key parts of the problem of providing access controls and addressing safety concerns. Each of these adds value, yet for these technical solutions to be capable of working well together and manageable to operate they will need a minimal shared context of what defines a secure system architecture.

Vision

There is a future where operators, administrators and developers feel confident creating new cloud native applications. They use cloud technologies with clear understanding of risks and the ability to validate that their security policy decisions are reflected in deployed software.

We envision that there could exist an ecosystem of tools that can simplify the experience of cloud native operators, administrators and developers, including:

  1. System security architecture that understands and accommodates the ever growing heterogeneity of systems and provides a framework to protect resources and data while servicing their users.
  2. Common vocabulary and open source libraries that make it easy for developers to create and deploy apps that meet system security requirements.
  3. Common libraries and protocols that enable people to reason about the security of the system, such as auditing and explainability features.

Publications

TAG Security has published several resources for the community, which can be found in the publications document.

Governance

STAG charter outlines the scope of our group activities, as part of our governance process which details how we work.

Communications

Anyone is welcome to join our open discussions of STAG projects and share news related to the group's mission and charter. Much of the work of the group happens outside of Security TAG meetings and we encourage project teams to share progress updates or post questions in these channels:

Group communication:

Leadership:

Slack governance

Refer to the slack governance document for details on slack channels and posting to the channels.

Meeting times

Group meeting times are listed below:

  • US: Bi-weekly on Wednesdays at 10:00am UTC-7 (see your timezone here)
  • EMEA: Bi-weekly on Wednesdays at 01:00pm London (see your timezone here)

Meeting minutes and agenda

Calendar

Zoom Meeting Details

Meeting Link: zoom.us/my/cncftagsecurity (Password: 77777)

One tap mobile:

Location Number
US - New York +16465588656,,7375677271#
US - San Jose +16699006833,,7375677271#

Dial by your location:

Location Number
US - New York +1 646 558 8656
US - San Jose +1 669 900 6833
US - Toll-free 877 369 0926
US - Toll-free 855 880 1246
Australia - Toll-free 1800 945 157

Or find your local number.

Meeting ID: 737 567 7271

Gatherings

Please let us know if you are going and if you are interested in attending (or helping to organize!) a gathering. Create a github issue for an event and add to list below:

Past events

New members

If you are new to the group, we encourage you to check out our New Members Page

Related groups

There are several groups that are affiliated to or do work and cover topics relevant to the work of Security TAG. These can be seen here

History

Members

STAG Chairs

  • Brandon Lum (@lumjjb), Google [Chair term: 6/3/2021 - 6/3/2023]
  • Aradhana Chetal (@achetal01), TIAA [Chair term: 6/3/2021 - 6/3/2023]
  • Andrew Martin (@sublimino), Control Plane [Chair term: 3/17/2022 - 3/17/2024]

Tech Leads

STAG Chair Emeriti

  • Dan Shaw (@dshaw), PayPal [Chair term: 6/3/2019 - 9/3/2020]
  • Sarah Allen (@ultrasaurus), [Chair term: 6/3/2019 - 6/3/2021]
  • Jeyappragash JJ (@pragashj), Tetrate.io [Chair term: 6/3/2019 - 6/3/2021]
  • Emily Fox (@TheFoxAtWork), Apple [Chair term: 9/28/2020 - 2/4/2022]

On-going projects

Policy team

Policy is an essential component of a secure system.

Bi-weekly meetings at 3:00 PM PT focus on policy concerns and initiatives.

Co-leads

  • TBD

Co-chair representative: @achetal01

Security reviews

Security reviews are a collaborative process for the benefit of cloud native projects and prospective users by creating a consistent overview of the project and its risk profile.

Facilitator: Justin Cappos (@JustinCappos), New York University

Facilitator: Matthew Giassa (@Iaxes), Cisco

Co-chair representative: @lumjjb

Software Supply Chain Security

Software Supply Chain attacks have come to the wider community's attention following recent high-profile attack, but have been an ongoing threat for a long time. With the ever growing importance of free and open source software, software supply chain security is crucial, particularly in cloud native environments where everything is software-defined.

Weekly meetings at 8:00 AM PT (50 min) (see your timezone here) See CNCF calendar for invite.

Facilitator for current deliverables is listed on the issue

Additional information

CNCF STAG reviews

As part of the CNCF project proposal process projects should create a new security review issue with a self-assessment .

Past events and meetings

For more details on past events and meetings, please see our past events page

About

🔐CNCF Security Technical Advisory Group -- secure access, policy control, privacy, auditing, explainability and more!

Resources

License

Unknown and 2 other licenses found

Licenses found

Unknown
LICENSE.md
Apache-2.0
LICENSE-code
CC-BY-4.0
LICENSE-document

Code of conduct

Stars

Watchers

Forks

Releases

No releases published

Packages

No packages published

Languages

  • Shell 78.0%
  • Makefile 22.0%