tag-security icon indicating copy to clipboard operation
tag-security copied to clipboard

Published 20 hours ago • verified publisher icon cncf

Cloud Native Top 10

Open jcchavezs opened this issue 1 year ago • 14 comments

With increased adoption of cloud native technologies, it is important to minimise risks. Certain types of configuration risks (or there-lack of) are more common than others. There is a need to have a standard awareness document which can be referenced by cloud native professionals which represents a broad consensus about the most critical security risks. So far, the OWASP top 10 has been widely used for awareness about web application risks. CNCF will be the right place to host top 10 risks for cloud native technologies such as Istio mesh which has gain more adoption in the industry.

TO DO:

  • [x] Project Lead: @jcchavezs and @jmbmxer
  • [x] STAG representative: @pratiklotia (Requires TL/Co-chair sponsor)
  • [ ] Project members: TBD
  • [ ] Initial meeting to define scope
  • [ ] SIG chairs for signoff
  • [ ] Logistics:
  • [x] Draft document
  • [ ] Call for comments from the community
  • [ ] PR to publish
  • [ ] CNCF Blog post

Draft scope:

This paper is intended to provide the community with a list of top 10 istio mesh configuration risks with a detailed example of what the risk looks like & how to come up with a secure configuration. It aims to provide an awareness document for organisations to identify the top risks that they should focus on.

jcchavezs avatar Mar 15 '23 09:03 jcchavezs

This is an awesome idea! Happy to help.

matthewflannery avatar Mar 15 '23 11:03 matthewflannery

There may be some overlap with existing OWASP Top Projects such as the OWASP Cloud Native Application Top Ten (seems to be in draft form still) and the Kubernetes Top Ten (a bit more mature)

szh avatar Mar 15 '23 13:03 szh

I propose that we fold in a rendition of the Kubernetes Top Ten into this proposal as a broader "Cloud Native Top Ten Security Risks" project. I am willing to port over and expand upon a reference for Kubernetes as well. Some of this was initially sparked by a post on Linkedin suggesting that the CNCF could be a good place for these types of materials.

jmbmxer avatar Mar 21 '23 23:03 jmbmxer

That's a good idea. Over the course, we have had a few challenges with service configurations and inconsistencies in documentation and/or our use-cases. Would be happy to help.

rashmin-maker avatar Mar 24 '23 18:03 rashmin-maker

Awesome @matthewflannery and @rashmin-maker, I suggest you come by the #tag-security-top-ten slack channel in cloud-native.slack.com to bootstrap the structure.

jcchavezs avatar Mar 24 '23 18:03 jcchavezs

Doodle is out to find set the bi-weekly meetings https://doodle.com/meeting/participate/id/b27x88Nd

jcchavezs avatar Mar 31 '23 18:03 jcchavezs

Hey folks, has a regular cadence for the meeting been selected? I'd like to participate and get involved.

ossfellow avatar May 02 '23 19:05 ossfellow

Great initiative!!! Please see how we can refer or reconcile with https://github.com/cncf/tag-security/blob/main/security-whitepaper/secure-defaults-cloud-native-8.md when working on this

PushkarJ avatar May 10 '23 23:05 PushkarJ

@jcchavezs I left a message in #tag-security-top-ten inquiring about the status of this project. Whenever you have time, it'd be great if you could also update here on where things are and whether you need help from other contributors to complete this.

anvega avatar Jun 21 '23 04:06 anvega

Really great idea. I am happy to help out here.

kevsecops avatar Jun 29 '23 11:06 kevsecops

This issue has been automatically marked as inactive because it has not had recent activity.

stale[bot] avatar Sep 17 '23 01:09 stale[bot]

@jcchavezs @jmbmxer is this still active? What help do you need from the TAG Security leads to make this a success?

PushkarJ avatar Apr 24 '24 15:04 PushkarJ

Hi @PushkarJ I am sorry I did not come back to you. Yeah indeed this is still an on going effort mainly on my side but I have been jiggling many balls for a while but now there is some stability so I can come back to it. This is indeed something that is evolving over time (I have been updating the talks I give about the topic overtime) and what TAG security could help with here is to help promoting the request for collaborators. On the next two weeks I will revamp the document and call for contributors.

jcchavezs avatar Apr 30 '24 18:04 jcchavezs

Thanks for your reply! @jcchavezs sounds like a really hectic last few weeks for you! Glad you are back at it now :)

Please feel free to share the document when it is ready here, on slack and in our regular weekly meetings 🙌🏼

PushkarJ avatar May 02 '24 16:05 PushkarJ