Security Process Improvements in Ceph and Rook
summary
Process shifts from manual triage to automated pipelines: scanners (Twistlock, Snyk/MEN, SonarQube, Dependabot) once returned 20,000 false positives, so vulnerabilities now flow into three trackers (upstream, Red Hat, IBM) and into a VIP pipeline in ServiceNow for verification and routing. The team enforces limit scope per person, separation of duties, labels per engineering/QA/build, automates routine dependency updates, and hardens Ceph/Rook with MFA for Dashboard, keyring improvements, Grafana lockdowns, and staged release rules.
AI-written summary · about
chapters (12)
- 0:00Introduction
- 1:46Old process challenges
- 4:35Manual process limitations
- 6:00Prioritizing CVEs differently
- 7:23Handling base OS CVEs
- 8:04New stage-based process
- 11:14Tracking and automation
- 13:19Dependency tracking improvements
- 15:03Architecture hardening focus
- 17:53Threat modeling introduction
- 20:39Secure design practices
- 21:20Conclusion and Q&A
related talks
36mCeph Security BoF
35mData Security and Storage Hardening in Rook and Ceph
30mData Security: Theoretical and Real World Approache...
18mData Security and Storage Hardening in Rook and Ceph
37mAchieving High Security at Scale with Microservices
34mContainer Vulnerability Management in Kubernetes
36mImproving Security while Reducing Toil with DevSecOps
43mBuilding Trust Through Proactive Security - Key Parts of the Trus...