Security Nutrition Labels for Cloud Native Projects
summary
Proposal that standardizes a security nutrition label for cloud native projects, published as YAML and intended for CNCF SIG-Security. Labels list concrete claims: network behavior (sends/receives/listens and ports), required Kubernetes privileges or cluster role binding, credential use (API keys, token scopes), signed git commits and builds, architecture diagram, threat model, third-party audit and a security contact. Examples include telepresence (proxy, optional listener), terrascan (builds signed, optional listener) and linkerd (TLS by default, audited).
AI-written summary · about
chapters (11)
- 0:00Intro
- 2:00History
- 4:05Apple App Store
- 4:43Why is this needed?
- 6:15Security Label Goals
- 7:23Front of Package Labels
- 9:39Label Contents
- 13:09Example - telepresence
- 15:32Example - terrascan
- 17:29Example - linkerd
- 18:11Example - label
related talks
23mCloud Native Security for the Rest of Us
41mCloud Native Security For The Rest Of Us
15mA Special Interest in Cloud Native Security
40mCreating Cloud Native Security
35mCloud Native Security for the Rest of Us
26mAn Introduction to Cloud Native Security
34mIntro: CNCF Security SIG – Sarah Allen & Jeyappragash Jeyakeerthi
37mCloud Native Security 101 - Introduction, Workflows and Best practices