Cloud Native Security Day North America 2020
2020-11-17
-- online --
as the organisers put it
VIEW THE VIRTUAL SCHEDULE JOIN THE EVENT That’s a wrap on Cloud Native Security Day NA 2020! Thank you to all the attendees, sponsors and speakers that joined us virtually this year.
who it's for
cloud security engineers, platform engineers, kubernetes operators, devops engineers, security architects, site reliability engineers
topics
eBPF dynamic image scanning; ephemeral sandbox image analysis; control plane audit log detection; detection as code regression tests; Cartography neo4j asset graphing; OpenID Connect short lived tokens; SPIFFE SPIRE with Parsec keystore partitioning; Istio Envoy Kafka filter; security chaos engineering; OPA policy enforcement for teams
| title | author | length |
|---|---|---|
| Dynamic Image Scanning Through System Tracing | Itay Shakury | 37m |
Static scanning misses evasive malware that unpacks and executes payloads only at runtime, so dynamic scanning runs images in an ephemeral sandbox and… | ||
| Building Effective Attack Detection in the Cloud | Alfie Champion, Nick Jones | 30m |
Cloud-native detection focuses on actual attack paths not buzzwords: it uses control plane audit logs (CloudTrail/Azure Audit/Kubernetes), service-specific… | ||
| Cartography: using graphs to improve and scale security decision-making | Alex Chantavy, Marco Lancini | 29m |
A free open-source tool, Cartography pulls cloud assets into a neo4j graph and runs daily cron jobs in Kubernetes (statefulset for neo4j, cron job for… | ||
| Cloud Security and how to leverage the shared responsibility model to your advantage | Eshrak Assaf, David Lebutsch | 09m |
Cloud shared responsibility is often misunderstood: 60% of orgs mistakenly expect providers to secure privileged access, causing misconfigurations like public… | ||
| Designing Secure Applications in the Cloud | Adora Nwodo | 27m |
Three concrete patterns for cloud app security: the gatekeeper pattern validates and sanitizes a single public endpoint before calling internal services; the… | ||
| Exit Stage Left: Replacing Theater with Chaos | Kelly Shortridge | 21m |
Argument: security theater creates slow, brittle delivery by adding approvals and blunt tools like scanners and gatekeeping that inflate friction and correlate… | ||
| Why OpenID Connect is More Secure then Certificates | Marc Boorshtein | 10m |
Certificates rely on an HSM and PKCS#11 to keep private keys safe but kubectl lacks PKCS#11 support and the Kubernetes API server has no CRL support, so long… | ||
| Hardware Backed Security For Multitenancy at the Edge with SPIFFE & PAR... | Paul Howard, Andres Vega | 13m |
Demo shows Parsec + SPIFFE/SPIRE integrated so hardware-backed keys are partitioned by workload identity. Two client processes run as Unix UIDs 1002 and 1003… | ||
| Welcome and Introductions | Emily Fox | 06m |
A community-run SIG for cloud-native security outlines concrete outputs and ways to join: 68 active contributors meet weekly, perform tooling reviews, and… | ||
| Capture the Flag Wrap Up & Summary | Andrew Martin, Magno Logan | 44m |
Six hands-on CTF scenarios reproduce real failures: a privileged container mounts host disks and exposes a node secret; a host PID namespace lets /proc reveal… | ||
| Event Wrap Up | Andrew Martin, Emily Fox, Brandon Lum, Jeyappragash Jeyakeerthi | 33m |
Cloud Native Security SIG reports five completed security assessments, each scoped to about security assessments (2–4 weeks) with roughly two weeks of active… | ||
| A Tale of a Meshi Kafka: Securing Kafka Deployment When Istio Is Used | Ariel Shuper, Nikolas Mousouros | 38m |
Explains that running Kafka on Kubernetes with Istio needs two fixes to be practical: sidecar as first-class so Envoy is ready before brokers and Zookeeper… | ||
| Enabling Autonomous Teams With Policy Enforcement at Yubico | James Alseth, John Reese | 38m |
Yubico replaces slow, manual RBAC reviews with automated policy enforcement using Open Policy Agent and cluster admission via Gatekeeper, plus local and CI… | ||
| nothing matches | ||