Ecosyste.ms: Awesome

An open API service indexing awesome lists of open source software.

Awesome Lists | Featured Topics | Projects

https://github.com/cncf/tag-security

🔐CNCF Security Technical Advisory Group -- secure access, policy control, privacy, auditing, explainability and more!
https://github.com/cncf/tag-security

access-control assessment cloud-native cncf safety secure-access security

Last synced: about 1 month ago
JSON representation

🔐CNCF Security Technical Advisory Group -- secure access, policy control, privacy, auditing, explainability and more!

Awesome Lists containing this project

README 

        
# Security Technical Advisory Group



![Cloud Native Security Logo](/community/resources/design/logo/cloud-native-security-horizontal-darkmodesafe.svg)



## Quick links



- [Meeting Information](#meeting-information)

- [Slack Information](#communications)

- [Working Groups](#working-groups)



## About Us



The CNCF Security Technical Advisory Group facilitates collaboration to exchange and produce knowledge and resources for building security in the cloud native ecosystem.



Cloud Native involves building, deploying, and operating modern applications in cloud computing environments, typically using open source. This complex ecosystem presents a technology risk landscape that demands rethinking application and information security through the lens of developer experience.



We aim to significantly reduce the probability and impact of attacks, breaches, and compromises. By empowering developers and operators to understand and manage the security posture of their systems, we strive to fulfill the promise of enhanced productivity and operational efficiency.



## Key Focus Areas



- **System Security Architectures**: Frameworks to protect resources and data.

- **Common Lexicon, Templates & Libraries**: Tools for developers to create secure apps.

- **Heuristics and Models**: Approaches for reasoning about system security.



## Publications



Below is a list of publications by TAG Security. For a comprehensive collection of our works in various formats, please visit the [publications](community/publications/README.md) directory.



| Publication | Date |

|-------------|------|

| [Formal Verification for Policy Configurations](community/working-groups/archive/policy/overview-policy-formal-verification.md) | August, 2019 |

| [Catalog of Supply Chain Compromises](community/catalog/compromises) | November 2019 - Present |

| [Software Supply Chain Best Practices](community/working-groups/supply-chain-security/supply-chain-security-paper/CNCF_SSCP_v1.pdf) | May, 2021 |

| [Evaluating your Supply Chain Security](community/working-groups/supply-chain-security/supply-chain-security-paper/secure-supply-chain-assessment.md) | May, 2021 |

| [Cloud Native Security Lexicon](community/resources/security-lexicon/cloud-native-security-lexicon.md) | August, 2021 |

| [Cloud Native Security Whitepaper](community/resources/security-whitepaper/v2/CNCF_cloud-native-security-whitepaper-May2022-v2.pdf) | May, 2022 |

| [Cloud Native Security Controls Catalog](community/working-groups/controls/phase-one-announcement.md) | May, 2022 |

| [Handling Build-time Dependency Vulnerabilities](community/working-groups/archive/policy/overview-policy-build-time-dependency-vulns.md) | June, 2022 |

| [Secure Software Factory: A Reference Architecture to Securing the Software Supply Chain](community/working-groups/supply-chain-security/secure-software-factory/Secure_Software_Factory_Whitepaper.pdf) | May, 2022 |

| [Secure Defaults](community/resources/security-whitepaper/secure-defaults-cloud-native-8.md) | February, 2022 |

| [Open and Secure - A Manual for Practicing Threat Modeling to Assess and Fortify Open Source Security](community/assessments/Open_and_Secure.pdf) | November, 2023 |



## Governance



Refer to the [Security TAG charter](governance/README.md) for our governance process.



## Communications



Join our open discussions and share news:



- [Email list](https://lists.cncf.io/g/cncf-tag-security)

- [CNCF Slack](https://slack.cncf.io/) #tag-security channel (Refer to the [contributing guidelines](CONTRIBUTING.md) for posting and participation details.)



## Meeting Information



- **Americas**: Weekly on Wednesdays at 10 am (UTC-7). [Zoom link](https://zoom-lfx.platform.linuxfoundation.org/meeting/92340369657?password=76e24ffd-69f2-41a8-8aed-13796805225d), Meeting ID: 923 4036 9657.

- **EMEA**: Bi-weekly on Wednesdays at 1 pm UTC+0 (adjusts for daylight saving). [Zoom link](https://zoom-lfx.platform.linuxfoundation.org/meeting/98348738138?password=70e6a945-563a-491f-8485-ecf7394ec13a), Meeting ID: 983 4873 8138.

- **APAC**: Bi-weekly on Wednesdays at 11 am (UTC+9). [Zoom link](https://zoom-lfx.platform.linuxfoundation.org/meeting/94315508827?password=0d7eaab8-a217-4c1b-b0a5-27ceded5743f), Meeting ID: 943 1550 8827.



Check your local timezone [here](https://time.is/). Meetings are listed on the [CNCF calendar](https://www.cncf.io/calendar/) and the [TAG Security Calendar](https://calendar.google.com/calendar/u/0?cid=MGI4dTVlbDh0YTRzOTN0MmNtNzJ0dXZoaGtAZ3JvdXAuY2FsZW5kYXIuZ29vZ2xlLmNvbQ).



To add a topic to the agenda, review our [process](governance/process.md#getting-on-the-agenda).



## New members



If you are new to the group, we encourage you to check out our

[contributing guidelines](CONTRIBUTING.md).



## Related groups



Explore groups affiliated with or relevant to Security TAG [here](governance/related-groups/README.md)



## Leadership



Details about the TAG Chairs, Tech Leads, and TOC Liaisons can be found on the [CNCF Technical Advisory Groups (TAGs) information page](https://github.com/cncf/toc/blob/main/tags/cncf-tags.md)



## TAG Emeritus Leaders



Thank you to all the [tag emeritus leaders](/community/assets/tag-emeritus-leaders.md) for your contributions to the success of this community.



### Working Groups



The TAG's working groups focus on specific areas and organize most community activities, including weekly meetings.

These groups facilitate discussions, engagement, and publications with key stakeholders, operating differently based on their needs.

Each group, led by a responsible leader, reaches consensus on issues and manages logistics. All materials, such as reports, white papers, documents, and reference architectures, are in the repository's /community directory.



| Project | Leads | STAG Rep |

|---------------------------------|---------------------------------------------|---------------------------------|

| [Automated Governance](/community/working-groups/automated-governance/README.md) | Brandt Keller | Matthew Flannery |

| [Catalog of Supply Chain Compromises](/community/catalog/README.md) | Santiago Arias Torres | Marina Moore |

| [Commons](/community/working-groups/commons/README.md) | Eddie Knight | Marco De Benedictis |

| [Compliance](/community/working-groups/compliance/README.md) | Anca Sailer, Robert Ficcaglia | Brandt Keller |

| [Controls](/community/working-groups/controls/README.md) | Jon Zeolla | Brandt Keller |

| [Security Reviews](/community/assessments/README.md) | Justin Cappos | Eddie Knight |

| [Software Supply Chain](/community/working-groups/supply-chain-security/README.md) | Michael Lieberman, John Kjell | Marina Moore |



## Additional information



### CNCF Security TAG reviews



For [CNCF project proposal process](https://github.com/cncf/toc/blob/main/process)

create a

new [security review issue](https://github.com/cncf/tag-security/issues/new?assignees=&labels=assessment&template=security-assessment.md&title=%5BAssessment%5D+Project+Name)

with a

[self-assessment](/community/assessments/guide/self-assessment.md).