Cloud Native Security Conference North America 2021
2021-10-12
-- online --
as the organisers put it
This site hosts a list of talks from various conferences on the topic of Cloud Native security.
| title | author | length |
|---|---|---|
| Opening Remarks | Dan Papandrea, Andres Vega | 03m |
Opening remarks state that cyber incidents cost 2.6 trillion dollars and argue no single vendor or project can fix it so the community must collaborate through… | ||
| Keynote: Leave it to the Machine - How to Leverage AI to Effectively Shift Left Sec... | Yuval Shchory | 12m |
Argues for using AI/ML to actually build actionable security controls: a discovery agent maps nodes, pods and namespaces and a learning mode turns observed… | ||
| Keynote: Like a Magic Eye Illusion: Seeing the Bigger Picture for Cloud-Native S... | Kirsten A. Newcomer | 11m |
A survey from Red Hat finds many teams claim “DevSecOps” but most only shift left with CI vulnerability scans; enterprise adoption of full feedback loops and… | ||
| Securing the Software Supply Chain with Open Source | Dan Lorenc | 09m |
Open source runs nearly everything (90–98% use open source) and apps pull in many dependencies (135 components average), and supply‑chain attacks spike… | ||
| The State of Vulnerability in Cloud Native Security | Magno Logan | 25m |
Aggregates 40+ CNCF security audit PDFs into a searchable GitHub repo and parses 40+ audit PDFs into a GitHub repo to extract 1) audit findings and 2)… | ||
| Protecting the Omniverse: How NVIDIA is Securing Containers | Adam Wallis | 21m |
NVIDIA integrates security into CI/CD to scan thousands of containers and manage hundreds of thousands of container digests, using Anchore open source engine… | ||
| Cloud Native Security Lexicon | Ragashree M C | 10m |
A community-curated lexicon of 40+ cloud native security terms maps each term to a concrete definition, expected uses, and operational pitfalls, with a two‑day… | ||
| Security Chaos Engineering for Fun and Profit | Kennedy Torkura | 24m |
Security Chaos Engineering (SCE) applies chaos experiments to verify preventive, detective and corrective controls across cloud layers, claiming layer‑agnostic… | ||
| Data Security and Storage Hardening in Rook and Ceph | Federico Lucifredi | 18m |
Explains concrete hardening steps for Rook + Ceph: map four network zones (cluster, storage access, public, client), enable Ceph protocol encryption (messenger… | ||
| Pinniped: A Unified Framework for User Authentication to Kubernetes Cluster | Mo Khan, Anjali Telang | 10m |
Pinniped provides a Kubernetes-native authentication stack that installs with kubectl apply and runs two core components, the pinniped supervisor (TLS ingress… | ||
| Service Authentication - Tokens or Certificates? | Marc Boorshtein | 13m |
Compares concrete tradeoffs: certificates give no secret on the wire but require secure key generation, OCSP/CRL revocation checking, and work best when… | ||
| It's Time We Start Securing Our CICD Pipelines | Shripad Nadgowda | 10m |
Claims a pipeline cannot be the root of trust and demonstrates concrete tooling: static signing of pipeline YAML, tasks and images with Sigstore/Cosign… | ||
| Cryptographic Signatures: A Building Block Not A Panacea | Marina Moore | 20m |
Cryptographic signatures guarantee only that a particular private key signed an artifact at a point in time and require surrounding policies to be meaningful… | ||
| Data Security: Theoretical and Real World Approache... | Ana McTaggart, Michael Hackett, Sean Anderson | 30m |
Rook Ceph operator automates packaging, cluster management, scaling and self‑healing for Ceph on Kubernetes and supports encrypted OSDs with LUKS, external KMS… | ||
| Keynote: Modern Least Privilege and DevSecOps | James Watters | 09m |
Argues that modern least privilege becomes practical when automation and platform affordances bake security into the developer experience, citing Cloud Native… | ||
| Security TAG Closing | Dan Papandrea | 16m |
Wraps up with a community-built capture-the-flag that ran 60 players through three escalating challenges, the red team delivering realistic but sometimes… | ||
| Supply Chain Security Reference Architecture | Priya Wadhwa, Alex Marshall | 10m |
Roadmap-style reference architecture that implements the CNCF white paper’s over 50 recommendations by defining components, interactions, and concrete tool… | ||
| Change is Hard - Securing the Future Today | Andrew Clay Shafer | 22m |
Argues security is a socio-technical problem and the practical path is building a shared platform that balances innovation and efficiency — the scope economy —… | ||
| Strengthening Supply Chain Security By Enforcing Policies Using OPA G... | Rita Zhang, Sertaç Özercan | 10m |
Open Policy Agent Gatekeeper enforces cluster policies using external data providers to validate and mutate images and metadata. It uses a tag-to-digest… | ||
| As Strong As the Weakest Link: Securing the Software Supply Chain | Brendan O'Leary | 12m |
SolarWinds compromise shows attackers breach a vendor’s CI/CD build infrastructure, inject DLLs (Sunspot) then deliver a trojanized payload (Sunburst), remove… | ||
| The Long and Windy Road that leads to Cloud Native Security | Frederick Kautz | 23m |
Define zero trust as an identity–policy–control framework and prove it on one app: issue short-lived X.509 certificates (use SPIRE or equivalent) so workloads… | ||
| SBOM: The Rest Of the Story | Emily Fox, Nisha Kumar, Allan Friedman | 27m |
Covers why SBOMs are a practical shared data layer not a silver bullet: SPDX and CycloneDX are the common formats, signing via sigstore helps provenance, and… | ||
| Replacing PSPs? Keep Bad Pods out of your cluster using Kyverno! | Shuting Zhao | 26m |
Kyverno is a Kubernetes-native admission controller that validates, mutates and generates resources to replace deprecated PSPs (PSP deprecated in 1.22 and… | ||
| Not-So-Fantastic Leaks, and Where to Find Them In Containers | Alex Goodman | 08m |
Builds reveal hidden baggage: a 230 MB app sitting inside a 3.2 GB image and leftover layers that keep secrets and dev artifacts. A Tekton pipeline builds with… | ||
| nothing matches | ||