A Sneak Peak Into Security Reviews with the Community
summary
A community-written security assessment book documents a repeatable process for CNCF projects: identify assets and actors, draw data‑flow diagrams, score threats with STRIDE plus CVSS/DREAD, then choose prevention/recovery/detection. Projects perform a self-assessment (PR to the TAG repo and Wed TAG review), or request a volunteer joint review for sandbox→incubation→graduation moves; reviewers declare conflicts, run hands‑on checks, and publish findings. Primary contributors include Justin kappos, Matthew Kisa, and Andrew Martin.
AI-written summary · about
chapters (12)
- 0:00Security assessments and community
- 3:10Purpose of security book
- 4:35Assessment vs audit differences
- 6:00Assets and actors in security
- 7:48Security goals and CIA Triad
- 9:12STRIDE threat framework
- 11:22Prioritizing security threats
- 12:47Response strategies for threats
- 13:31Self-assessment process
- 14:34Joint assessment for maturity
- 15:58Community contributors and steps
- 17:27Q&A
related talks
36mLevel up Your Security Career with the TAG Security Community
34mCNCF SIG-Security Intro
15mA Special Interest in Cloud Native Security
36mThe Devil in the Details: Kubernetes’ First Security Assessment
05mA Maintainer’s Tour Of Tag Security And Compliance
24mStaring Into the Abyss With the Security Technical Advisory Group
40mLearning to build an effective security design review program
19mFrom Code to Cloud: Embedding Security