CloudNativeSecurityCon North America 2023
2023-02-01..2023-02-02
Seattle, United States
[CloudNativeSecurityCon North America 2023, CloudNativeSecurityCon North America 2024]
as the organisers put it
register SPONSOR SUBMIT A PROPOSAL View the Schedule CloudNativeSecurityCon 2023 is a wrap! Thank you to all of the attendees, speakers, and sponsors that joined us this year! To experience the best…
| title | author | length |
|---|---|---|
| Tutorial: Hands-on Hacking Kubernetes and Ways to Prevent It | Eric Smalling | 01h 13m |
Walks through exploiting a contrived Python remote code execution to steal a mounted service account token, use curl and kubectl (via kind 1.24 on Docker… | ||
| Securing Self-Hosted GitHub Actions with Kubernetes & Actions-Runner-Controller | Natalie Somersall | 41m |
Open-source actions-runner-controller provides autoscaling, ephemeral GitHub Actions runners on Kubernetes but hands all infrastructure security to operators… | ||
| Self Healing GitOps: Continuous, Secure GitOps Using Argo CD, Helm and OPA | Upkar Lidder | 31m |
Shows a concrete pipeline that stops and remediates unsafe deployments: Argo CD uses a Argo CD pre-sync hook to run Terrascan (scans Helm charts, Kubernetes… | ||
| "Keyless" Code Signing Without Fulcio | Nathan Smith | 34m |
Keyless signing works without Fulcio by combining three actual pieces: an identity provider (OIDC, AWS IAM, or corporate IdP), a CA that mints short-lived… | ||
| On Establish a Production Zero Trust Architecture | Frederick Kautz | 39m |
Argument and recipe for rolling out Zero Trust: establish cryptographic identities for workloads using SPIFFE/SPIRE and short‑lived x509 certificates, enforce… | ||
| How to Secure Your Supply Chain at Scale | Hemil Kadakia, Yonghe Zhao | 40m |
Yahoo describes a concrete pipeline: Screwdriver produces builds and sends provenance into Grafeas, images get SBoMs and vulnerability data, signatures use… | ||
| Spicing up Container Image Security with SLSA & GUAC | Ian Lewis | 36m |
Shows how to add SLSA provenance to container images and cryptographically verify them using Sigstore tools (Fulcio/Rekor/cosign) with GitHub Actions and… | ||
| So You Want to Run Your Own Sigstore: Recommendations for a Secure Setup | Hayden Blauzvern | 33m |
Recommendation checklist for running a private Sigstore: operate Fulcio CA and Rekor transparency log (public instances have a 99.9% SLO and went GA in… | ||
| Zero Trust Workload Identity in Kubernetes | Michael Peters | 37m |
Explains how SIFFE identity and the Spire runtime replace shared secrets with workload-bound x509/JWT credentials, issuing short-lived SVIDs that agents rotate… | ||
| Keynote: Welcome + Opening Remarks | Priyanka Sharma | 17m |
First CloudNativeSecurityCon in Seattle highlights hard numbers and concrete tools not platitudes 7.1 million cloud native developers prompts a required… | ||
| Cloud Native Security 101: Building Blocks, Patterns and Best Practices | Rafik Harabi | 34m |
Explains concrete controls: maps five lifecycle phases (code build provision deploy run) to checkpoints, advocates image signing plus admission controllers… | ||
| Keynote: The Next Steps in Software Supply Chain Security | Brandon Lum | 14m |
Industry builds strong provenance: SLSA and Tekton produce rich SBOMs and attestations, and standards like SPDX and CycloneDX plus VEX are arriving. The… | ||
| SBOMs, VEX, and Kubernetes | Kiran Kamity, Jonathan Meadows, Allan Friedman, Andrew Martin, Rose Judge | 36m |
Pick one of the SBOM formats (CycloneDX or SPDX) and generate SBOMs at build time as part of CI; treat signing and provenance as phase two work and add VEX… | ||
| Securing the Superpowers: Who Loaded That EBPF Program? | John Fastabend, Natalia Reka Ivanko | 36m |
Tetragon provides an eBPF auditing and enforcement pipeline that hooks the BPF verifier to capture every program load and map creation with Kubernetes… | ||
| Keynote: Learn by Hacking: How to Run a 2,500 Node Kubernetes CTF | Andrew Martin, Andres Vega | 13m |
Run a Kubernetes CTF pipeline that provisions up to 2,500 nodes per day using an open-source breach simulator and knative scaling-to-zero driven by a pub/sub… | ||
| Who Are You? I Really Want to Know… the Magic Behind OIDC | Eddie Zaneski | 34m |
Explains how OpenID Connect acts as a thin layer over OAuth to provide workload identity federation so CI and Kubernetes can trade short-lived ID tokens (JWT)… | ||
| Security Threat Modeling Live from Scratch Session | Andrew Martin | 42m |
Presents a lightweight, one-hour session threat-modeling script derived from the Mozilla rapid risk assessment and applied to Flux (a GitOps deployer), using a… | ||
| Zero Trust in the Cloud with WebAssembly and WasmCloud | Kevin Hoffman | 33m |
Claims that WebAssembly eliminates buffer-overflow exploits by trapping undefined behavior and forbids arbitrary pointers, demonstrated with wasmTime rejecting… | ||
| Keynote: Picture this! Solving Security Problems Visually with eBPF | Liz Rice | 11m |
eBPF instruments the kernel to produce rich events that are turned into graphs and dashboards using Cilium Hubble flows, Prometheus policy verdict metrics, and… | ||
| CNI or Service Mesh? Comparing Security Policies Across Providers | Rob Salmond, Christine Kim | 33m |
Compares CNI plugins (Calico, Cilium) and service meshes (Istio, Linkerd, Envoy) by concrete enforcement points and failures: kernel-level eBPF or iptables… | ||
| Security as Code: A DevSecOps Approach | Xavier René-Corail | 37m |
Security checks are implemented as code using CodeQL, which extracts code into a DB and runs declarative queries to find flows and misconfigurations. Example… | ||
| Finding the Needles in a Haystack: Identifying Suspicious Behaviors... | Jeremy Cowan, Wasiq Muhammad | 39m |
AWS uses eBPF to instrument the kernel for eBPF syscall tracing, capturing process creation, file, network and DNS events and enriching them with container and… | ||
| Modifying the Immutable: Attaching Artifacts to OCI Images | Brandon Mitchell | 36m |
Explains how OCI now lets you attach SBOMs and signatures to an immutable image by pushing artifact manifests (examples: CycloneDX and SPDX) and linking them… | ||
| 12 Essential Requirements for Policy Enforcement and Governance with OSCAL | Robert Ficcaglia | 43m |
Twelve concrete governance requirements enumerate what must be collected, parameterized and enforced: 12 requirements spell out catalog curation, profiles… | ||
| Sponsored Keynote: From Google to NIST — The Future of Cloud Native Security | Zack Butcher | 05m |
Claims five runtime policy checks as the minimum for cloud-native zero trust: message authenticity and anti-eavesdropping, encryption in transit, cryptographic… | ||
| 84 The Four Golden Signals of Security Observability | Duffie Cooley | 14m |
Migrates claim: kernel eBPF instruments Linux syscalls to capture four concrete signals — Process Execution, Network Sockets, File Access, Layer 7 Network… | ||
| Securing User to Service Access in Kubernetes | Maya Kaczorowski, Maisem Ali | 40m |
Compares concrete controls for user→service access in Kubernetes: ClusterIP, LoadBalancer, Ingress, NetworkPolicy, service mesh, bastion, IPsec and WireGuard… | ||
| Keynote: Back to the Future: Next-Generation Cloud Native Security | Matt Jarvis | 14m |
Forecasts five concrete shifts that could reshape cloud native security: Q day from Shor’s algorithm threatening RSA and prompting NIST‑style post‑quantum key… | ||
| Tutorial: How to Build a K8s Admission Controller fro... | Stephen Giguere, Angela Gizzi, Matt Johnson | 01h 23m |
Don't miss out! Join us at our upcoming event: KubeCon + CloudNativeCon Europe in Amsterdam, The Netherlands from 18 - 21 April, 2023. Learn more at… | ||
| Identity Based Segmentation for a ZTA | Zack Butcher, Ramaswamy Chandramouli | 38m |
Advocates replacing perimeter rules with cryptographic identities enforced at the runtime proxy layer, using service mesh proxies (Envoy) with mTLS and SPIFFE… | ||
| Container Patching: Making It Less Gross Than the Seattle Gum Wall | Greg Castle, Weston Panther | 42m |
Presents a pragmatic system: about a few thousand GKE/Anthos containers are managed by standardizing on distroless base images in a small set of registries… | ||
| Keynote: Fighting The Next War - Future Threats to OSS and Software Supply Chain... | Brian Behlendorf | 17m |
History shows protocol fixes like DNS cache poisoning fix and the Bernstein case enable cryptography, yet old bugs persist: a 2007 tarfile CVE propagates… | ||
| Network Security at Scale: L3 Through L7 at Splunk | Mitch Connors, Bernard Van De Walle | 31m |
Splunk runs about 35 clusters across AWS and GCP with one VPC per cluster, uses public/internal NLBs plus Transit Gateways and Aviatrix for a flat L3 fabric… | ||
| Handling JWTs: Understanding Common Pitfalls | Bruce MacDonald | 25m |
Explains the exact failure modes: the RFC-allowed none algorithm can make receivers accept unsigned tokens, symmetric secrets can be brute-forced (demoed with… | ||
| Avoiding IAC Potholes with Policy + Cloud Controllers | Andrew Martin | 41m |
Shows a concrete pipeline: Crossplane composite resources provision AWS S3/RDS, Kyverno validating admission controllers block noncompliant CRs, and Lula+OSCAL… | ||
| Package Transparency for WebAssembly Registries | Kyle Brown | 34m |
Warg is a concrete protocol that makes a Wasm package registry auditable by publishing per-package append-only signed logs and a global verifiable map (Merkle… | ||
| Cloud Native Security Landscape: Myths, Dragons, and Real Talk | Edd Wilder-James, Loris Degioanni, Kim Lewandowski, Isaac Hepworth, Randall Degges | 39m |
Panelists argue concrete priorities: inventory first — many orgs still lack visibility despite 85–97% of commercial products using OSS — then know fix enforce… | ||
| From the Cluster to the Cloud: Lateral Movements in Kubernetes | Yossi Weizman, Ram Pliskin | 36m |
Shows concrete exploit paths and fixes: Kubernetes RBAC that lets a pod update its own Deployment can spawn privileged pods with nodeSelectors to seize node… | ||
| CSI Container: Can You DFIR It? | Alberto Pellitteri, Stefano Chierici | 39m |
Runtime DFIR for Kubernetes environments explains concrete steps and tools: use Falco alerts and Prometheus metrics to spot suspicious wget and spawned shells… | ||
| Demystifying Zero-Trust for Cloud Native Technologies | Kishore Nadendla, Mariusz Sabath, Asad Faizi, Aradhna Chetal, Philip Griffiths | 35m |
Zero trust means eliminating implicit network trust and enforcing identity and policy across ephemeral cloud native workloads; the panel describes using x509… | ||
| What's a Zero-Trust Tunnel? Exploring Security and Simpler Operations w... | Jim Barton, Marino Wijay | 37m |
Istio Ambient Mesh introduces a sidecarless mode where a per-node ztunnel DaemonSet forms hbone TCP-over-HTTP tunnels and derives workload identity to create… | ||
| Leveraging SBOMS to Automate Packaging, Transfer, and Reporting of D... | Ian Dunbar-Hall, Jerod Heck | 26m |
Claims an automated pipeline that packages, validates and moves dependencies into air‑gapped secure environments using CycloneDX SBOMs as the packaging format… | ||
| Verifiable GitHub Actions with eBPF | Jose Donizetti, Itay Shakury | 40m |
A GitHub Action wraps the eBPF-based Tracee runtime to profile and verify builds: it starts and stops tracing, blocks the workflow until the tracer is ready… | ||
| Sponsored Keynote: Cloud Security’s Hidden Force: Threat Detection | Loris Degioanni | 05m |
Argues that runtime threat detection is as critical as shift‑left controls and serves as the last line of defense, offering visibility where supply‑chain and… | ||
| Not All That’s Signed Is Secure: Verify the Right Way with TUF and... | Zachary Newman, Marina Moore | 36m |
Signatures only protect you if verification checks who signed and what they actually claim; a registry can return a valid signature from evil@hacker.com and it… | ||
| Standardization & Security - A Perfect Match | Ravi Devineni, Vinny Carpenter | 35m |
Northwestern Mutual standardizes a single SCM (migrating from GitHub Enterprise to GitLab) and narrows tool choices to a vetted set, then enforces a… | ||
| Lightning Talk: My First Supply Chain Security Pull Request as a 13-Year-Old | Neil Naveen | 03m |
A middle schooler describes finding that gh CLI (cli/cli) lacked automated dependency updates, then added Dependabot config to the repo using the GitHub… | ||
| How Do You Trust Your Open Source Software? | Naveen Srinivasan, Brian Russell | 27m |
OpenSSF Scorecard programmatically scores open source projects by running ~70 checks (examples: binary artifacts, pinned deps, code review) and exposes results… | ||
| Sponsored Keynote: Why Developer Laptop Security is Key to Securing Your CI/CD Pip... | Saurabh Wadhwa | 06m |
Developer laptops are the most common initial foothold into CI/CD pipelines, citing recent LastPass and Dropbox incidents and frequent supply‑chain compromise… | ||
| Delivering Secure Healthcare Applications with OSS | Robert Wood, Gedd Johnson | 39m |
A Kubernetes platform called Batcave uses exclusively open source components (notably Big Bang from Platform One) to stand up secure EKS clusters with EKS +… | ||
| Sharing Security Secrets: How to Encourage Security Advocates | Cailyn Edwards | 31m |
Describes building an automated GitHub CI checks pipeline that runs security baselines early in the proposal/prototype phase, generates a report sent to… | ||
| Beyond Cluster-Admin: Getting Started with Kubernetes Users and Permissions | Tiffany Jernigan | 33m |
Shows how to provision users with TLS certs via OpenSSL and kubeadm CA files under /etc/kubernetes/pki for self‑hosted clusters and via the CSR API for managed… | ||
| Improving Secure Pod-to-Pod Communication Within Kubernetes Using... | Thomas Edward Hahn, Mark P Hahn | 38m |
Deploys a mutating admission webhook that creates a Kubernetes CSR per pod, approves it via any Kubernetes CSR signer (cert-manager, Vault, etc.), and injects… | ||
| Sponsored Keynote: Kubernetes is the Perfect Platform for Enforcing Zero Trust Security | Fei Huang | 06m |
Uses Log4j as a case study: Log4j exploited within one week, patches took weeks to months, so the model shifts from reactive scanning to proactive runtime… | ||
| Cryptographic Agility: Preparing Modern Apps for Quantum Safety and Beyond | Natalie Fisher | 26m |
Claims that hard-coded crypto caused Heartbleed fallout—4.5 million health records stolen and 200,000 systems unpatched in 2019—and argues enterprises need… | ||
| OmniBOR: Bringing the Receipts for Supply Chain Security | Frederick Kautz | 31m |
OmniBOR captures a canonical Merkle DAG of every build artifact by recording file-level git OIDs (20-byte SHA-1 by default with migration paths toward SHA-2)… | ||
| Sponsored Keynote: Trust and Risk in the Software Supply Chain | Emmy Eide | 06m |
Cites a 742% increase in annual supply chain attacks and that six of seven project vulnerabilities come from transitive dependencies, argues automation and… | ||
| Solving Multi-Service Without a Service Mesh | Evan Anderson | 33m |
Kubernetes primitives can replace a mesh but require work: use cert-manager or a self-signed cluster-local CA for intra-cluster TLS, rely on token projection… | ||
| Do This, Not That – Lessons from 7 Headline Grabbing Security Breaches | Maya Levine | 32m |
Seven cloud breaches: a malicious AWS Marketplace AMI runs crypto miners; a leaked root key lets attackers spawn EC2 instances and install miners; a Log4j… | ||
| More Than Just a Pretty Penny! Why You Need Cybersecurity in... | Callan Andreacchi, Michaela Flatau | 29m |
ChatGPT-generated spear-phishing is already bypassing grammar checks and nearly fooled an employee, and attackers are recruiting on the open market while… | ||
| From Illuminating to Eliminating Crypto Jacking Techniques in Cloud Native | Mor Weinberger | 29m |
Research from Aqua's Nautilus team shows cryptojackers move from browser and unpatched hosts into containers, Kubernetes and CI/CD by exploiting exposed Docker… | ||
| Keynote: Panic in San Francisco: The Critical Vulnerability That Wasn't | Shane Lawrence | 14m |
October 2022 OpenSSL patch addresses a punycode decoder off by one that copies a four‑byte unsigned value into a buffer, creating a limited buffer overflow… | ||
| Security++: Hide Your Secrets via a Distributed Hardware Security Mod... | Iris Ding, Malini Bhandaru | 27m |
A distributed HSM is implemented with Intel SGX enclaves so private keys are generated, sealed and used locally instead of shipped to cloud HSMs; attestation… | ||
| Taming Attestation for the Cloud Native World with Parsec | Paul Howard | 30m |
Parsec presents a language‑neutral microservice that replaces brittle PKCS#11 shims to provision keys and now emit attestation evidence across TPM and PSA/EAT… | ||
| Yes, Application Security Leads to Better Business Value. Learn How from Experts. | Larry Carvalho, Hillary Benson, Kirsten A. Newcomer, David Zendzian | 44m |
Panel argues that applying DevSecOps and policy-as-code cuts remediation time, improves compliance evidence, and lets teams ship faster; GitLab-style… | ||
| Journey to Cloud-Native, K8s and Trying to Secure It. | Graham E. Chukwumaobi | 35m |
Begins with a monolith-to-microservices claim and shows a working example: three REST services (user, inventory, shipping) built with FastAPI, containerized… | ||
| Lightning Talk: A Secure Software Supply Chain for Open Policy Agency (OPA) Policies | Omri Gazitt | 05m |
OPA policies are packaged, tagged and pushed as OCI artifacts using the policy CLI and an OPCR-compliant registry (examples: GHCR, Docker, AWS). Images are… | ||
| Unpacking Open Source Security in Public Repos & Registries | Ben Hirschberg | 34m |
Scans cover ~44,000 container images from ~180 registries, ~2,000 git repos and ~164,000 YAML/Helm files and compare a general sample to CNCF graduated… | ||
| Sponsored Keynote: OpenClarity: A Community-Led Approach to Cloud-Native Applicat... | Sarabjeet Chugh | 06m |
Cisco announces the OpenClarity suite of open source tools for cloud‑native security and claims production deployment inside its commercial products Panoptica… | ||
| TAG Security Cloud Native Security Whitepapers Overview | Shlomo Zalman Heigh | 19m |
TAG Security publishes actionable resources: Cloud Native Security Whitepaper v2 (v3 in progress) with PDF/Markdown and an audio recording currently at v1 that… | ||
| Securing Diverse Supply Chains Across Interconnected Systems | Wayne Starr, Aaron Creel | 21m |
Shows how Syft, Grype, OWASP Dependency Check are layered into CI to generate SBOMs and run vulnerability scans, and how Zarf packages those SBOMs and images… | ||
| Keynote: Closing Remarks | Emily Fox, Liz Rice, Brandon Lum | 02m |
Announcement enforces an event code of conduct and says violations go to registration; organizers explicitly enforce inclusion. Conference thanks sponsors for… | ||
| Learning from Supply Chain Failures and Best Practices in Other Industries | Demian Ginther | 30m |
Software supply chain failures cost real money and lives: SolarWinds infects ~18,000 orgs with ~ $90M cleanup, a PHP git compromise forces a move to 2FA and… | ||
| Get Your Security Priorities Straight! How to Identify Workloads Und... | Ben Hirschberg, Arie Haenel | 27m |
Cubescape maps controls to MITRE-style ATT&CK categories and builds attack chains by linking failed controls so combined failures raise risk more than… | ||
| Let’s Talk Software Supply Chains with TAG Security | Michael Lieberman | 25m |
Outputs include the Software Supply Chain Security Whitepaper, a living catalog of supply chain compromises with dozens of writeups, and a Secure Software… | ||
| Container Factory for Aerospace & Defense Enterprises | Sarah Miller, Melissa Robertson | 29m |
Collins Aerospace builds a self‑service "container factory" that produces declarative ephemeral build environments so legacy avionics code (Borland C++, GCC49… | ||
| Security Does Not Need to Be Fun: Ignoring OWASP to Have a Terrible Time | Dwayne McDaniel | 27m |
Argues OWASP is a practical toolbox, not just a mission statement, listing roughly 157 usable projects, 18 flagship and 34 lab projects and the surprising… | ||
| When SysAdmins Quit: Protecting Kubernetes Clusters When the Owner of Multiple... | Arun Krishnakumar | 27m |
Shows that admin KUBECONFIG cannot be revoked directly and proves a working manual fix: create a new root and intermediate CAs, use cfssl to generate new… | ||
| Lightning Talk: Securing Your Source Repositories - 5 Tips to Get Started! | Billy Lynch | 04m |
Enable account two-factor authentication (Google Authenticator or U2F keys) and expect platforms to enforce it; require protected branches with two-person… | ||
| Security That Enables: Breaking Down Security Silos in the DevOps Ecosystem | Saurabh Wadhwa | 21m |
Explains that attackers increasingly target developer tooling and container registries, citing a CircleCI impersonation that leads to credential theft and the… | ||
| Lightning Talk: Cloud(Security)Events -- A Lightweight Framework for Security React... | Evan Anderson | 06m |
CloudEvents provides a small standardized envelope to convert Avro Protobuf or JSON records and route them into logs, BigQuery, Snowflake or S3 for storage and… | ||
| Keynote: Closing Remarks | Emily Fox, Liz Rice, Brandon Lum | 01m |
Conference wraps with gratitude for an in person program that grew over two days and a concrete set of next steps: a tech security meet up happens during lunch… | ||
| Keynote: Opening Remarks | Liz Rice | 01m |
Warm welcome and brief recap of day one celebrating attendee connections and sponsor booths while promising another fantastic lineup for day two and a schedule… | ||
| Keynote: It Takes a Community to Raise a Conference: From Security Day to CloudNativeSe... | Emily Fox | 11m |
Conference begins in 2019 as a one‑day Security Day spun up from GitHub issue #209 with 14 volunteers and a Trello plan, grows into seven events in under four… | ||
| Good Fences Make Good Neighbors: Making Cross-Namespace References More Secure with Re... | Nick Young | 38m |
Kubernetes needs an explicit two-way handshake for safe cross-namespace references: the owner of the target object must create a ReferenceGrant in the same… | ||
| A Sneak Peak Into Security Reviews with the Community | Ragashree MC | 17m |
A community-written security assessment book documents a repeatable process for CNCF projects: identify assets and actors, draw data‑flow diagrams, score… | ||
| Lightning Talk: Software Dark Matter is the Enemy of Software Transparency | Santiago Torres-Arias | 05m |
Claims that untracked files — called software dark matter — make SBOMs incomplete and reduce scanner utility. Uses the static analysis tool Trevi and a… | ||
| Mapping Motives Tells a Story: Analysis of 2,000 Enterprise Cloud Detec... | David Wolf, Joshua Smith | 41m |
Analysis of roughly 6,000 live cloud detections across ~400 customers maps alerts to the MITRE ATT&CK Cloud matrix and yields concrete gaps: out-of-the-box… | ||
| nothing matches | ||