Cloud Native SecurityCon North America 2022
2022-10-24..2022-10-25
Detroit, United States
as the organisers put it
register SPONSOR SUBMIT A PROPOSAL View the Schedule Attendee Guide View the Livestream That’s a wrap on Cloud Native SecurityCon at KubeCon + CloudNativeCon NA 2022! Thank you to all the attendees…
| title | author | length |
|---|---|---|
| Keynote: Crossing the Kubernetes Network Policy Chasm | Michael Foster | 05m |
Argues that the gap is human not technical and shows a working open source flow (StackRox and the MP guard project) that automatically synthesizes Kubernetes… | ||
| Securing Access to Kubernetes Infrastructure with Kubernetes Zero Trust Principles | Mohan Atreya | 26m |
Claims a working open source proxy called Paralus that keeps clusters cloaked behind firewalls by having cluster agents dial out on HTTPS (port 443) to an… | ||
| Cloud Native Security for the Rest of Us | Tiffany Jernigan | 23m |
Maps cloud native security into three concrete areas: platform hardening (prefer managed Kubernetes, lock down etcd and the cloud metadata server, enforce Pod… | ||
| Verifiable eBPF Traces for Supply Chain Artifacts with Witness and Tetragon | Cole Kennedy | 27m |
Integration of Witness with Cillium Tetragon captures eBPF traces of build processes to produce signed attestations and a bill of materials; ptrace is… | ||
| Building Images for the Secure Supply Chain | Adrian Mouat | 28m |
Argues that supply-chain security needs provenance, reproducibility and smaller images, and demonstrates tooling that actually delivers those things: uses… | ||
| How’s Your Supply Chain with Your Insecure OSS Ingestion? | James Holland | 26m |
A policy-driven pipeline named CSSI is built on Tekton & Open Policy Agent to ingest OSS, run scorecards, signature checks, Snyk vulnerability scans and… | ||
| Uncovering the History of Your Software Artifacts | Mikhail Swift | 15m |
Archivist indexes In-Toto attestations into a graph-backed store and exposes a GraphQL API so policies can find real provenance instead of guessing. A demo… | ||
| Conan.Io – Lessons Learned from Securing 40,000 C++ Packages | Diego Rodriguez-Losada Gonzalez | 31m |
Conan Center claims 0 security incidents while serving ~1 million downloads and ~25 TB/month, storing 1.4 million binary packages (20 TB) built from 1,400… | ||
| Why Machines Deserve Rights: Rethinking Automated Infrastructure Access with OSS Te... | Kenneth DuMez | 30m |
Claims that Teleport Machine ID replaces long‑lived shared creds with per‑machine identities using short‑lived x509 certificates, built‑in RBAC and centralized… | ||
| Closing Remarks | Eric Smalling | 03m |
Brief rundown of what actually happened today: sponsors get called out and a free beer reception is confirmed downstairs; a recurring conference bingo card… | ||
| See It to Believe It: Bringing Observability to Otherwise ... | Parth Patel, Shripad Nadgowda | 28m |
Claims a practical pipeline to record low-level build behavior so CI-produced images carry verifiable evidence that they ran without unexpected network or file… | ||
| Fileless Attack - Detecting the Undetectable | Carol Valencia | 28m |
A live demo builds a container with a binary that writes and executes code directly in memory using memfd_create and shows it running under an innocuous… | ||
| Panel Discussion: Say Hi to the New Couple in the Town – DockerSlim and Kyverno – Making Your Kub... | Mritunjay Sharma, Shuting Zhao, Ruhika Bulani | 41m |
Demo shows DockerSlim shrinking an nginx image from about 142 MB to 12.2 MB image and producing an auto-generated Seccomp profile; a kind cluster mounts that… | ||
| Secure CI/CD Using JSON Web Token (JWT) | Dov Hershkovitch | 28m |
Shows how to stop embedding secrets in CI by using JWT with OIDC so GitLab CI jobs can exchange a short-lived ID token for cloud or Vault credentials… | ||
| Beyond Proof of Concept: Keys to a Successful SPIRE Rollout in Production | Eli Nesterov | 29m |
Production SPIRE requires decisions on trust domains, PKI shape, and deployment model rather than vague benefits. Real-world deployment at ByteDance scales to… | ||
| Lightning Talk: OPAL: The Open Source GitOps Enabled Platform for Building Authorization | Asaf Cohen | 08m |
OPAL is an open-source administration layer for OPA that adds Git as source-of-truth and real-time JSON patches to push policy and data updates; it runs a… | ||
| Getting More Confident with Your Security Helper Libraries Thanks to Go Fuzzing | Jeremy Matos | 24m |
Go fuzzing (Go 1.18) is used to prove and extend fixes for a real path traversal in Grafana OSS by generating thousands of inputs until predicates fail… | ||
| Lightning Talk: Assessing Environments Against Cloud Native Security Be... | Pratik Lotia, Jon Zeolla | 19m |
Don’t miss out! Join us at our upcoming event: KubeCon + CloudNativeCon Europe 2023 in Amsterdam, The Netherlands from April 17-21. Learn more at… | ||
| Policy-Based Governance for End-to-End Integrity Control of... | Yuji Watanabe, Jayashree Ramanathan | 26m |
Claim: enable end-to-end integrity for governance policies by signing, securely distributing signing keys, and enforcing signature checks on clusters… | ||
| Welcome + Opening Remarks | Pratik Lotia | 07m |
Morning welcome outlines logistics: CTF in room 333 with six levels and help via the CNCF Security Slack; sessions split between room 330A/B and room 321 so… | ||
| The Eye of Falco: You Can Escape but Not Hide | Stefano Chierici, Lorenzo Susini | 34m |
Falco is extended to track Linux capabilities at runtime by building initial state from /proc and instrumenting syscalls (fork/clone/execve/capset) so rules… | ||
| Pwning the CI (with GitHub Action Workflows) | Stephen Giguere | 28m |
A public repo (example: Checkov) accepts a malicious PR that replaces workflows and runs attacker code on self-hosted runners, exfiltrates environment… | ||
| Hands-on Workshop: Confidential Containers: Bringing Confid... | Mikko Ylinen, Tobin Feldman-Fitzthum | 01h 14m |
Confidential Containers is a CNCF Sandbox project (accepted early 2022) that ships a runtime operator (first release end of September) which installs… | ||
| Hands-on Workshop: Network Policies - The Not-So-Hard Way | Raymond de Jong, Tracy Holmes | 56m |
Shows how Cilium built on eBPF enforces identity‑based networking (labels become identities) and inspects DNS and HTTP for precise rules. Live demo deploys a… | ||
| Source Attestations with Gitsign | Billy Lynch | 10m |
Gitsign adds verifiable attestations to git commits by storing signed blobs in special refs inside the repo, using the Sigstore keyless flow and Rekor log so… | ||
| Hands-on Workshop: Batten Down the Hatches! A Cluster Security Journey | Steve Wade | 01h 06m |
Hands‑on lab that boots a GKE cluster in Cloud Shell, clones a workshop repo and runs a 70‑minute audit workflow: inventory APIs/images, deploy example… | ||
| Introducing the OWASP Top Ten for Kubernetes | Jimmy Mesta | 22m |
Community-curated OWASP Kubernetes Top Ten lists the ten highest-risk Kubernetes failure modes backed by practitioner data and already has ~400 stars and… | ||
| Keynote: Vulnerability Data is Not Enough: The Case for an Actionable UI | Kara Yimoyines | 09m |
Claim: vulnerability feeds alone don’t reduce risk; platform teams face thousands to tens of thousands of CVEs and need a UI that joins CVE data… | ||
| Keynote: Detecting Threats in GitHub with Falco | Loris Degioanni | 09m |
Falco extends runtime security to GitHub via a GitHub plugin that creates a webhook and listens for events in real time, detecting pushed secrets (shows file… | ||
| Closing: "And, That's a wrap!" | Marina Moore, Ragashree M C, Andrew Martin, James Cleverley-Prance | 17m |
Closing recap lists concrete outcomes: the CTF runs across 50 clusters, 80 flags, 11 hints, 560 total points with 74 flag submissions and tightly fought… | ||
| Opening Remarks + CTF Overview | Andrew Martin | 09m |
Over 90% of open source packages have fixes available, so supply chain and OSS security are front and center with concrete remediation paths and volunteer… | ||
| Day in the Life of a Base Image: The Evolution of Vulnerabilities in the Most Popular C... | Ayse Kaya | 29m |
Analysis of the top 165 Docker Hub images (together accounting for 30% of pull volume) uses daily scans and time series on over 900,000 unique containers with… | ||
| Panel: Securing the Golden Path: Adding Guardrails for Developers Without Getting in Their Way! | Aradhna Chetal, Elizabeth Vasquez Alban, Kapil Bareja, Jim Bugwadia, Anil Karmel | |
Panelists describe concrete guardrails: an internal developer platform with declarative Kubernetes templates, admission controllers and runtime enforcement… | ||
| Keynote: Why Developer Laptop Security is Key to Securing Your CI/CD Pipeline | Jeremy Colvin | 05m |
Developer laptops are the highest value entry point into CI/CD because attackers can steal SSH keys credentials and tooling access and pivot into build servers… | ||
| Lightning Talk: Securing K8s Pods from Within: A Runtime Approach | Rahul Arvind Jadhav | 09m |
Kubernetes pods expose any injected binary to the mounted service account token, letting an exploit perform lateral movement; the proposed fix is runtime… | ||
| Know Your Dependencies: A Guide to Automating Dependency Assurance | Steve Judd | 26m |
Modern applications contain huge hidden trees of dependencies — one product examined has 1500 dependencies with only 30 direct — and roughly half of surveyed… | ||
| nothing matches | ||