tag-security
tag-security copied to clipboard
cncf
[Suggestion] Collaborate with broader community on supply chain security attack catalog
Description: The Security TAG has done some work based on work by @SantiagoTorres. OpenSSF is looking at potentially starting their own catalog or want to contribute to existing catalogs. There is also a lot of other work in the community outside of CNCF and OpenSSF working on this as well that we should figure out how to collaborate with.
This issue is here to track that collaboration.
@SantiagoTorres @TheFoxAtWork @lumjjb
I'm more than happy to discuss this. Ideally I think having a one-stop-shop for this catalog and such would be ideal, we could perhaps join forces with the OpenSSF and make it a joint effort. Part of what at some point I was hoping to see derived from the catalog was:
- A more formal description of the attacks
- perhaps a web site/queryable interface for people to more interactively explore the attacks, their vectors, their impact etc.
- On that note, I wonder if we could also work on some viz aspects of the same.
Overall, I see a lot of people refer to it to motivate/understand the threat space, so kudos for everybody that worked on this!
Thanks for opening this @mlieberman85 ! Yea this is a great opportunity to get together to work towards the common goal! What do you think the best way to engage would be? A couple of us can drop by an OpenSSF meeting or vice versa, and/or we could talk on the issue.
This issue has been automatically marked as inactive because it has not had recent activity.
![stale[bot] avatar](https://avatars.githubusercontent.com/in/1724?v=4 "Published by a pub.dev verified publisher"){kind=small}
@mlieberman85 which working group should this be discussed in with the OpenSSF? Can we put it on one of the upcoming agenda?
This issue has been automatically marked as inactive because it has not had recent activity.
Closing this issue as we've continued to maintain the compromise catalog with many external contributions. Perhaps a stretch goal to revisit is how to host it on the microsite or as its dedicate page. For now, though, I'll proceed to close the issue.
