Cloud Native SecurityCon Europe 2022
2022-05-16..2022-05-17
Valencia, Spain
as the organisers put it
An event designed to foster collaboration, discussion and knowledge sharing of cloud native security projects and how to best use these to address security challenges and opportunities.
who it's for
security engineers, devops engineers, platform engineers, software supply chain engineers, site reliability engineers, engineering managers, serverless developers
topics
eBPF enforcement and Tetragon; Tekton Chains provenance; Sigstore cosign and Fulcio attestations; VEX machine-readable vulnerability statements; in-toto attestation collections; SBOM generation and use; fuzzing CNCF projects and OSS-Fuzz integration; wasmCloud capability-driven sandboxes; container runtime protection and Landlock; policy-based CI/CD enforcement with Kyverno; Rekor transparency log storage
| title | author | length |
|---|---|---|
| Real Time Security - eBPF for Preventing attacks | Liz Rice | 32m |
eBPF already enforces network policy via Cilium uses eBPF to enforce NetworkPolicy and seccomp-bpf limits syscalls, while Falco currently only alerts. The talk… | ||
| Putting the Supply Chain Pieces together: A Deep Dive into the Secure softwar... | Michael Lieberman | 20m |
An implementation of the CNCF Secure Software Factory that ties Tekton Chains, SPIRE identities, Sigstore and Kyverno to produce signed attestations and… | ||
| VEX! or... How to Reduce CVE Noise With One Simple Trick! | Frederick Kautz | 31m |
VEX provides a machine-readable statement that links CVEs to software components and says whether a product is actually known affected, known not affected, or… | ||
| Securing the Supply Chain with Witness | Cole Kennedy | 23m |
Witness is an open source framework that implements in-toto and bundles CI-produced attestations into signed collections using DSSE and short-lived… | ||
| Fuzzing the CNCF Landscape | Adam Korczynski, David Korczynski | 36m |
Over the last year the team integrates fuzzers into more than ten CNCF projects (Kubernetes, Argo, Etcd, Containerd, Vitess, Linkerd2‑proxy, runc, Flux and… | ||
| Lightning Talk: Repurposed Purpose: Using Git's DAG for Supply Chain Artifact Resolution | Aeva Black | 11m |
GitBOM repurposes Git’s Merkle DAG so git object IDs become canonical, unique, immutable artifact IDs that link every source file through build outputs into a… | ||
| Security Champions: The What, Why, and How | Ann Marie Fred | 27m |
Proposes scaling security from about 1% to 10% of the engineering population by appointing one security champion per small team, each completing roughly 10–15… | ||
| Using CNCF Best Practices for Software Supply Chain to Guide and Enha... | Ryan Gibbons, Conor Rogers | 35m |
CNCF best practices become an actionable control framework: mapping 22+ principles into a spreadsheet of control objectives, owners and evidence, then… | ||
| Towards the Hardened Cloud-Native Cornerstone: Container Runtime Protection from Secur... | Kailun Qin | 25m |
Containers still show frequent kernel and runtime CVEs and a Tencent Cloud chart reports container escape among top user concerns and 7% of users running with… | ||
| Shrinking Software Attack Surface with WebAssembly & CNCF Wasmcloud | Liam Randall | 30m |
Demonstrates that WebAssembly plus CNCF wasmCloud turns libraries and platform glue into hot‑swappable capabilities so apps contain only business logic… | ||
| Opening and Introductions | V Körbes | 05m |
Conference opens by announcing a CTF over two days and a schedule that includes concrete tooling and techniques: devsecops automation, fuzzing exercises, a… | ||
| Protect the Pipe! A Policy-based Approach for Securing CI/CD Pipe... | Shripad Nadgowda, Jim Bugwadia | 26m |
Shows a concrete pipeline security stack that is implemented and demoed end to end: Tekton pipelines pack into Tekton bundle + cosign signed OCI artifacts… | ||
| Purple Teaming Like Sky’s the Limit – Adversary Emulation in the Cloud... | Christophe Tafani-Dereeper | 24m |
Stratus Red Team is an open source tool that reproduces cloud attacks against live AWS and Kubernetes accounts, packaged as a single Go binary with Terraform… | ||
| First Steps to Full Lifecycle Security with Open Source Tools | Rory McCune, Anais Urlichs | 01h 21m |
Hands-on demos use Trivy to scan container images, GitHub repos, Dockerfiles, Kubernetes manifests and Terraform, showing JSON output, jq filtering for a CVE… | ||
| Keynote: DevSecOps and the Art of Not Ending Up On the Front Page | Fabio Rapposelli | 12m |
SolarWinds-style supply-chain compromises spread signed malware through updates and prompt Executive Order 14028 requiring SBOMs for US federal procurements… | ||
| The Unexpected Demise of Open Source Libraries | Liran Tal | 29m |
Stories show small maintainer actions breaking huge ecosystems: left-pad removed (≈2.5M downloads) unpublishes nested deps and breaks builds; faker.php… | ||
| Lightning Talk: What’s Inside Your Container Image? How to Audit All the Dependencies... | Steve Judd | 09m |
Describes a concrete pipeline that inventories every container image, generates an s-bom in CycloneDX for each image, scans licenses and CVEs with OWASP… | ||
| Dissecting the Discovery of the 0-Day Supply Chain Vulnerability in Argo CD | Moshe Zioni | 28m |
Discovery shows CVE-2022-24348 lets a user-supplied Helm valueFiles entry bypass Argo CD’s path checks because Go’s parseRequestURI treats crafted inputs as… | ||
| Lighting Talk: Lessons Learned from Writing Thousands of Lines of IaC | Eran Bibi | 08m |
Three concrete lessons: the Terraform state file stores cleartext secrets and must be encrypted and access-restricted because leaked state gave away AWS keys… | ||
| CTF Overview and Experience | Lewis Denham Parry | 23m |
A live warmup shows a CTF platform that actually spins up 60–70 clusters on conference Wi Fi and provisions access via a Taskmaster via Slack that returns an… | ||
| Lightning Talks: Detecting Data Exfiltration on the Edge with Pixie | Zain Asgar | 10m |
Pixie uses eBPF to collect request bodies and system events from every node without changing apps, running analysis locally via a Python/Pandas-like scriptable… | ||
| Vanquishing Vulnerabilities in Valencia | Alba Ferri Fitó, Eric Smalling | 28m |
A live Log4Shell RCE demo shows a crafted JNDI/LDAP payload giving a reverse shell into a Tomcat pod (netcat listener), exposing Kubernetes env vars and a… | ||
| Deep Dive: Serverless Security (STAG Presentation) | Andrew J Krug, Ragashree M C, Ashish Rajan, Ariel Shuper | 25m |
Updated CNCF STAG whitepaper documents concrete risks and defenses: examples include bypass API Gateway HTTP endpoints that sidestep built‑in auth, excessive… | ||
| Keynote: Why Wait? Find Cloud Risks and Threats in Real Time with Stream Detection | Loris Degioanni | 08m |
Falco now ingests CloudTrail as a live stream so cloud logs never need to be copied to a SIEM for detection, using an open source Falco CloudTrail plugin plus… | ||
| Lightning Talk: What Have We Learned from Scanning Over 10K Unique Clusters with Ku... | Shauli Rozen | 10m |
Kubescape scans over 10K unique Kubernetes clusters, YAML and Helm charts against NSA‑CISA and MITRE ATT&CK rules and reports that 100% of clusters have at… | ||
| Lightning Talk: lockc - Containing the Containers That Do Not Contain | Michal Rostecki | 14m |
lockc is an open source MAC-style enforcement agent (Rust + C, moving to pure Rust) that attaches eBPF programs to eBPF LSM hooks via Aya to enforce… | ||
| Closing + CTF Wrap Up | Brandon Lum, Andy Martin | 14m |
Community announces new guidance and papers (secure software factory reference architecture, supply chain best practices, SBOM guidance, NIST mappings) and… | ||
| Top 5 Reasons (and 5 Myths Debunked) to Invest in Securing the Software Supply Chain | Hector Linares | 22m |
SBOM alone is not enough: the talk argues that ingredient lists (CycloneDX, SPDX, GitBom, Black Duck) require signed attestations, provenance and runtime… | ||
| TUF Maintainer Panel Discussion | Andrew J Krug, Asra Ali, Marina Moore, Trishank Karthik Kuppusamy, Jussi Kukkonen | 40m |
TUF has working implementations in python, go, rust and is already used by organizations like Datadog, AWS BottleRocket, Google Fuchsia and Sigstore; the… | ||
| Lightning Talk: Knowing Your Serverless Functions: Signing and Verifying Serverless... | Ariel Shuper | 10m |
Cosign and Sigstore integrate into CI/CD to sign serverless code and deployment artifacts, signatures and certs get stored in AWS KMS or secret storage, and a… | ||
| Co-Chair Update | Ragashree MC | 05m |
Community update on active Tag Security projects and how to join: publishes a cloud native security white paper plus focused papers on supply chain and… | ||
| Keynote: Evolutions in data privacy: threats and opportunities | Kirsten A. Newcomer | 06m |
Encryption remains the core control for cloud native data confidentiality and the talk argues for moving beyond perimeter controls to homomorphic encryption… | ||
| nothing matches | ||