CloudNativeSecurityCon North America 2024
2024-06-26..2024-06-27
Seattle, United States
[CloudNativeSecurityCon North America 2023, CloudNativeSecurityCon North America 2024]
| title | author | length |
|---|---|---|
| SaaC – Security as a Culture, the Distributed Advocacy | Deep Patel | 36m |
Security fails most often from specific mistakes: predictable salts, secrets checked into logs or world-readable, directory‑traversal payloads, CSRF ignored at… | ||
| API Security: Code-to-Cloud Context for Complete Protection | Idan Plotnik, Patrick Sullivan | 42m |
Enterprises see 90,000 new APIs across ten customers and a 1:159 ratio of appsec to developers, so the session shows a combined Code-to-runtime pipeline that… | ||
| Evasive Maneuvers: Strategies to Overcome Runtime Detection Tools | Amit Schendel | 30m |
Explains concrete bypasses against eBPF-based runtime detectors: demonstrates an io_uring-based syscall evasion that creates and reads symlinks without… | ||
| Malicious Compliance Automated: Building Secure Containers and Obfusca... | Kyle Quest, Duffie Cooley | 33m |
Demonstrates that image minification plus metadata obfuscation makes scanners blind while the app still runs: using Docker Slim and the minify toolkit shrinks… | ||
| Lightning Talk: Speak Egress and Exit: A Look at Securing Traf... | Nina Polshakova, Ariana Weinstock | 05m |
A live demo builds Istio CRs—ServiceEntry, Gateway, VirtualService, DestinationRule—and shows a curl pod first getting a 502, then a 200 once the ServiceEntry… | ||
| Lightning Talk: Security Down to the Kernel | Justin Garrison | 06m |
Argues for shrinking the OS surface instead of stacking defenses, showing Talos Linux reduced to 12 binaries and a runtime with four processes to minimize… | ||
| CSI Forensics: Unraveling Kubernetes Crime Scenes | Alberto Pellitteri, Stefano Chierici | 37m |
Automatic checkpointing captures an ephemeral compromise within seconds and preserves enough state to do real DFIR: Kubernetes checkpoint (v1.25+; beta v1.30)… | ||
| Navigating the Quantum Readiness Journey: Securing Kubernetes with Quantum-Resis... | Tomas Gustavsson | 30m |
Demo builds an EJBCA PKI issuing Dilithium root and subordinate CAs, then runs an Open Quantum Safe Apache server and OQS curl client using hybrid TLS and… | ||
| Detection Engineering in Kubernetes Environments: Wrangling Security Data Out of You... | Dakota Riley | 29m |
Claims that defenders need two minimum data sources — runtime syscall/CIS-call instrumentation and Kubernetes audit logs — and shows concrete detections and… | ||
| Leveraging the Linux Kernel for Building a Zero-Trust Environment With... | Marton Sereg, Zsolt Varga | 39m |
A Linux kernel module named camet intercepts socket syscalls, issues x509 identities bound to processes, performs the mTLS handshake entirely in kernel space… | ||
| Championing Security: Scaling Security at Every Level | Dwayne McDaniel | 36m |
Security teams run about 100 to 1 short, so the practical fix is empowering embedded security champions on every team who spot problems, ask the right… | ||
| Security Champions LeaderBoard - Building and Gamifying the Security Culture at Your... | Aseem Shrey | 27m |
Built a company-wide security champions leaderboard that awards points and levels for actions (identifying or fixing P0/P1s, completing training) and… | ||
| Lightning Talk: Securing Your Systems with Service Mesh | Tyler Schade | 06m |
Five-minute introduction that claims service mesh makes mTLS everywhere practical by injecting sidecar proxies via a control plane that handles certificate… | ||
| Navigating the Intersection: AI’s Role in Shaping the Secure Open Source Software Ecos... | Harry Toor | 21m |
OpenSSF outlines concrete defensive steps and active problems: OSS can backdoor AI (example hypothetical PyTorch backdoor altering protein design), data… | ||
| Lightning Talk: Don’t Make Me Impersonate My Identity | Cynthia Thomas | 05m |
Claims that Workload Identity Federation is the recommended way to give pods cloud identities, using the cluster as an OIDC provider so pods present JWT-like… | ||
| Below the Radar: Identifying Hidden Threats Within the Development Ecosystem | Yakir Kadkoda | 30m |
Research finds Kubernetes secret objects (base64 encoded) leaking Docker registry credentials in public repos; Kubernetes Secret Docker config/json exposed… | ||
| Avengers Assemble: Threat Modeling Kubernetes Clusters at a... | Sai Charan Teja Gopaluni, Jamal Arif | 33m |
Shows a real EKS incident where a RoleBinding grants cluster-system:anonymous → cluster-admin allowing kubectl port‑forward to read API‑server metadata and… | ||
| Metrics That Matter: How to Choose Cloud Security KPIs for Your Business | Emma Yuan Fang | 35m |
Organizations often collect metrics but fail to surface them to leadership: across ~20 customers nearly 90% claim metrics matter yet zero achieve board… | ||
| Sigstore: Past, Present and Future Directions | Luke Hinds, Bob Callaway | 36m |
Sigstore claims to be the de facto OSS signing stack with 58 repos and a community-run public service that records 101 million signatures in a transparency… | ||
| Accelerating AI Securely with GVisor | Lucas Manning | 30m |
gVisor is an application kernel OCI runtime that intercepts syscalls in user space, implementing a Linux ABI in Go and using a seccomp RET trap platform that… | ||
| Building Bridges in Open Source: Connecting Academic Talent with Indu... | Ben Smith-Foley, Sam Begin | 29m |
University-run open source program AROS connects companies (IBM, Red Hat, Boeing) to students who build and maintain real artifacts like a CNI test suite using… | ||
| CVE Context Matters, but Do All Vulnerabilities Really Matter? | Shubha Badve, Ross Tannenbaum | 30m |
Scanners produce wildly different results for the same image — four scanners can report completely different sets of CVEs — so focus on feeds, per-product… | ||
| How to Generate VEX Automatically for Your Project | Shlomo Zalman Heigh, Ben Hirschberg | 33m |
Automatic VEX generation for container projects uses Kubescape plus Inspector Gadget eBPF to observe runtime file and memory use, cross-references SBOMs… | ||
| Amplifying Impact: Documentation and Supply Chain Security | Michelle Irvine | 43m |
Google Cloud’s DORA survey (36,000+ responses) measures an eight‑attribute documentation quality score and links it to security and delivery outcomes, finding… | ||
| Is the Internet on Fire? Strategies for Mitigating Open Source... | Andrew Martin, Michael Lieberman | 32m |
Open source packages repeatedly carry real-world implants and zero days (Log4Shell, Sunburst, typo‑squatting) that bypass CI and SCA; defenders build an asset… | ||
| Securing CI/CD Runners Through eBPF Agent | Mert Coskuner, Cenk Kalpakoglu | 30m |
An open source tool called control uses an eBPF agent plus an OPA/Rego policy engine to monitor and allow-list outbound IPs and DNS responses from CI/CD… | ||
| Scan, Patch, VEX - Using Open Source Tools to Manage... | Toddy Mladenov, Sertaç Özercan, Itay Shakury | 42m |
Starts with a 1,500-vulnerability base image that yields 165 high+critical findings, then applies OpenVEX via vctl and registry attachment to drop that to 160… | ||
| Learn to Navigate the Perils and Pitfalls of Multi-Tenant Identity... | Fabienne Bühler, Livio Spring | 22m |
Multi-tenant IAM grows from a simple login UI into dozens of hard requirements: OAuth2 (75 pages) and OIDC (44 pages) differences, per-tenant password hashing… | ||
| Threat Modelling: How to Improve Your Kubernetes Security Posture with Threat Mod... | Maxime Coquerel | 37m |
Presents a reproducible process: start with an architecture analysis (using Microsoft FastTrack for Azure architecture review), then do access control mapping… | ||
| Where Does Your Software (Really) Come from? | Trevor Rosen | 36m |
GitHub ships Artifact Attestations: a signing flow that binds any artifact built with Actions back to the originating repo and commit using OIDC keyless keys… | ||
| Sponsored Keynote: What Can You Do in 5 Minutes? | Alexander Lawrence | 05m |
Sponsored keynote argues cloud security must shrink timelines to the 555 Benchmark with 5 seconds to detect, 5 minutes to triage, and 5 minutes to respond… | ||
| Keynote: Welcome + Opening Remarks | Chris Aniszczyk | 09m |
Community updates that matter now include almost 200 projects in the CNCF landscape, recent graduations like Cilium and Falco, and funded security work… | ||
| End-to-End Encryption for Container Checkpointing in Kubernetes | Radostin Stoyanov | 32m |
Adds built-in CRE encryption to checkpoint/restore (CRIU) using the TLS key infrastructure, encrypting protocol-buffers with ChaCha20-Poly1305, intercepting… | ||
| A Mouthful of Mayhem: Taste Test and Gut Response to SLSA, GUAC, and Supply Chain’... | Shane Lawrence | 36m |
Survey of concrete tools and a working workflow: SBOM generators (CycloneDX/SPDX) from ProtoBom, sigstore + cosign + rekor for signing and immutable logs… | ||
| Proactive Kubernetes Security: Anomaly Detection and Runtime Alertin... | Amit Schendel, Remi Minnebo | 37m |
A proof‑of‑concept called KubeCop proof-of-concept inside Kubescape uses an eBPF profiler to build 24‑hour application profiles (demo uses 2 minutes) and… | ||
| Shadow Vulnerabilities in AI/ML Data Stacks - What You Don’t Know... | Avi Lumelsky, Nitzan Mousseri | 37m |
Open-source AI stacks harbor RCE via SnakeYAML and default misconfigurations that bind management APIs to 0.0.0.0, enabling model theft, poisoning, and remote… | ||
| Keynote: TAG Security, You're It! | Eddie Knight | 17m |
TAG Security summarizes concrete outputs and gaps: published white papers (cloud native security, supply chain, secure software factory) plus a reference… | ||
| Keynote: K8s Security Safari: Hunting Threats in the Wild Wild Cloud | Stav Ochakovski, Ariel Szarf | 12m |
Focuses on EKS on AWS: uses CloudWatch, CloudTrail and GuardDuty, and inspects Kubernetes API server audit logs and the authenticator log to find threats… | ||
| User Namespaces in Kubernetes: Security and Flexibility - Pick Both | David Leadbeater | 40m |
Kubernetes 1.30 enables user namespaces in beta so containers can map an internal root to an unprivileged host UID, reducing damage from escapes; demo shows a… | ||
| The Runtime Rodeo; Where Open Source Image Behavior Is Tamed | Jimmy Mesta | 33m |
Proposes a cryptographically verifiable runtime behavioral fingerprint for container images, built from eBPF kernel telemetry and emitted as a runtime… | ||
| Threat Modeling for AI Apps with Attacks as Code | Priyanka Tembey, Glenn McDonald | 25m |
Describes encoding MITRE ATLAS and OWASP LLM risks as repeatable experiments so teams can run Secops-Chaos against third‑party models and Kubernetes stacks… | ||
| Brave New World: Welcoming New AI Identity Challenges | Gabriel L. Manor | 32m |
Claims that AI creates a new programmable identity class and that verification must become multi‑dimensional ranking rather than binary allow/deny… | ||
| Kubernetes Deep Dive: Elevating ML Workload Monitoring to Art | Ziwen Ning, Geeta Gharpure | 24m |
A concrete recipe for making ML on Kubernetes resilient: use an always‑on node problem detector daemonset (configured via ConfigMap regexes against kmsg) to… | ||
| Keynote: Security in the Open - How Industry and Community Ben... | Cailyn Edwards, Jonathan Whitaker | 16m |
Okta details building OpenFGA (a CNCF Sandbox now in incubation) as an Apache 2.0 permission engine that feeds directly into the commercial Okta FGA product… | ||
| Teach Your SBOM New Tricks with Bomshell | Adolfo García Veytia | 38m |
bomshell is a CEL-based scripting tool that reads SPDX and CycloneDX (JSON or tag‑value), uses protom as a protom neutral graph IO layer, and runs recipes to… | ||
| Drawing Lines in the Sand, or Running Unprivileged eBPF in Kubernetes | Nikola Grcevski | 25m |
eBPF often does not need full privileged:true: on modern kernels (>= 5.8) a minimum of CAP_BPF only (kernels >=5.8) plus usually CAP_PERFMON to read perf… | ||
| Leveraging Cryptographic Lineage for Context and ConnectedTrust | Yogi Porla | 37m |
Builds a cryptographic chain of custody for AI requests that binds short‑lived SPIFFE identities to signed, nested claims so each hop proves provenance and… | ||
| Embracing the Future: The Effortless Mutual TLS and Rich Layer 7 Authz Policy Without Sid... | Lin Sun | 38m |
Istio implements a two-layer, sidecar-less mesh: a per-node zero-trust tunnel daemonset that handles layer‑4 mTLS and TCP routing, plus an Envoy-based waypoint… | ||
| Everyone’s Starting to Look SPIFFE: MTLS and Identity with Linkerd & Teleport | Dave Sudia | 40m |
Linkerd and Teleport are wired to use SPIFFE SVIDs so Linkerd’s mesh expansion can mTLS to workloads outside Kubernetes; a demo uses k3d, Linkerd CRDs, tbot… | ||
| Keynote: Closing Remarks | 02m | |
Housekeeping notes remind attendees that an event code of conduct is in force and will be enforced and that concerns should go to registration for staff… | ||
| Keynote: Demystifying Secure Application Communication with Zero Trust: Identity, Integri... | Lin Sun | 19m |
Demo builds a Node.js server and curl client in k3d, shows a full manual OpenSSL mTLS flow with generated keys, CSRs and certs, then flips a label to enroll… | ||
| One Project, Different Angles: How to Secure and Observe with Cilium | Christine Kim | 22m |
Cilium uses eBPF to provide CNI networking, an optional per-node Envoy-based service mesh, Hubble observability, and Tetragon runtime security. Install via… | ||
| A Needle in a Haystack: How to Find a Threat Hidden in Over 6 Billion Logs Per Day | Brian Davis | 37m |
Pipeline ingests over 6 billion cloud-control-plane records per day into durable files, routes them with S3 + SNS + SQS, standardizes varied formats to an… | ||
| Network ACLs Made Easy: Establishing Zero Trust Network Policies in a Few C... | Juno Im, Yonghwi Jin | 33m |
Collects seven days of AWS VPC Flow Logs (67 GB compressed, ~1 TB decompressed), aggregates by IP/port and parses hundreds of millions of lines with a Rust… | ||
| Implementing a Multi-Tenant, Relationship-Based Authorizatio... | Evan Anderson, María Inés Parnisari | 40m |
Minder replaces a custom, database-backed authorization system with OpenFGA, moving users/groups/roles into a declarative model that supports hierarchical… | ||
| Tutorial: Automating Configuration and Management of your GitHub... | Dania Valladares, Evan Anderson | 59m |
Minder is an open source platform that automates GitHub repository configuration and enforcement across dozens to hundreds of repos (users report 50–100… | ||
| Container Images & Security 101: 5 Need to Know Facts | Phil Estes | 36m |
Container images are concrete object graphs: an image is a manifest config layers trio hashed into a DAG so runtimes verify each piece, and multiarch indexes… | ||
| Keynote: Securing Kubernetes, the Upstream Way | Rey Lejano | 11m |
Kubernetes upstream security focuses on fixes that scale: SIG Security formed in 2020 after a 2019 third‑party audit (37 findings) and drove a KEP that… | ||
| Shift Down Security! How Platform Teams Can Help Break the Logjam | Jim Bugwadia, Poonam Lamba | 38m |
Argues that platform teams must implement policy as code and guardrails so developers don’t shoulder every security task, demonstrating concrete wins: swapping… | ||
| Keynote: A Vision for a Secure Software Supply Chain | Marina Moore | 12m |
Sixty‑one percent of businesses report a supply‑chain hit (Gartner), and concrete incidents include a malicious backdoor in XZ packages, Dependabot… | ||
| How Does a Workload Authenticate an API Request?: Implementing Transaction Token... | Yoshiyuki Tabata | 37m |
Implements the IETF Transaction Tokens draft using Keycloak as both authorization server and transaction token service by adding a custom Keycloak Token… | ||
| Tutorial: Hacking Istio: The Good, the Bad, and the Misconfigured | Nina Polshakova, Peter Jausovec | 44m |
Hands‑on lab exposes real Istio misconfigurations: clusters come preinstalled with Ambient mode and vulnerable policies to exploit, and participants must chain… | ||
| Keynote: Closing Remarks - Day 2 | 01m | |
Organizers thank attendees and note the program’s steady growth while urging continued connection with projects and peers, calling the week an honor to serve… | ||
| Keynote: Sugar Ray.io on K8s: Shut the Door, Baby! | Greg Castle, Cynthia Thomas | 14m |
Recent Internet scanning finds misconfigured Ray clusters with unauthenticated dashboard and jobs APIs exposed, allowing attackers to pickle malicious objects… | ||
| Keynote: Opening Remarks - Day 2 | r leano ray | 01m |
Advocates an upstream-first approach to Kubernetes security and breaks down concrete results from SIG Security work showing which components received audits… | ||
| Tutorial: Demystifying and Enabling Workload Identity Across the Cloud Native Ecosystem | Andrew Block, Anjali Telang, Trilok Geer, Mariusz Sabath, Maia Iyer | 01h 05m |
Hands‑on demo deploys SPIFFE/SPIRE via Helm, installs torac UI for visibility, then configures Vault + CSI sidecar to replace a hardcoded MySQL credential with… | ||
| All I Know About Cybersecurity I Learned from Fungus | Alexander Lawrence | 24m |
Compares three concrete threat models to fungal behaviors: a Rebirth-style botnet that infects gaming services, sells access in a pay‑to‑play model, installs… | ||
| Level up Your Security Career with the TAG Security Community | Andrew Martin | 36m |
TAG Security performs hands‑on security assessments for CNCF projects (Flux, Kubeflow, Flatcar), producing joint assessment reports, threat models and… | ||
| Keynote: We’re VEXing the Cloud Native Landscape. Bring Your Code! | Adolfo García Veytia | 12m |
A practical report on bootstrapping VEX into cloud native workflows: a lightweight OpenVEX feeds format, two spec revisions after testing with three major… | ||
| Keynote: Security Education Through the Art of Storytelling | Ann Wallace | 13m |
Year-long rebuild replaces generic OWASP slides with an OCTA top 10 built from code reviews and live incident patterns, delivered as short, evergreen videos… | ||
| Bridging Mesh Enclaves: Securing and Maintaining Mesh Heterogeneity | Lukonde Mwila | 31m |
Demonstration shows a working bridge using SPIFFE/SPIRE to issue interoperable identities (X.509 or SVIDs) to Envoy sidecars and a custom Envoy mesh, with a… | ||
| Demystify Modern Signing: Keys, Certs, and Envelopes | John Kjell | 33m |
Compares Cosign, Notation, TUF and in-toto by walking signatures, envelopes and certificates, using Sigstore/Witness to mint an attestation and exporting the… | ||
| Guardians of the Dataverse: Securing the AI Supply and Data Chain | Frederick Kautz | 34m |
Maps NIST SP 800-204D thinking and in-toto attestation onto centralized AI/ML pipelines, arguing for signed CI/CD-produced models, data provenance, and… | ||
| Kubernetes Node Firewalling from the Inside Out | Jef Spaleta, Justin Garrison | 42m |
Shows a concrete setup: Talos (OS) boots a four‑node cluster, opens three ports opened (6443 for Kube API, 8472 for VXLAN, and the Talos API) over a WireGuard… | ||
| IAM Confused: Decoding 8 Real World Cloud Identity Breaches | Maya Levine | 36m |
Eight real breaches show repeatable failure modes: attackers use credential harvesting (open buckets, GitHub, Terraform state), tools like AWS CLI and pacu… | ||
| Cloud Native GRC | Brandt Keller, Jon Zeolla | 40m |
Argument that Policy-as-Code plus machine-readable controls turns GRC from paperwork into continuous automation, backed by a live demo: a CLI called Lula reads… | ||
| The Story of Crush: The Microservice That Navigated the Cloud Native O... | Mattias Gees, Tom Meadows | 37m |
A runnable Go microservice uses a SPIFFE SVID from SPIRE (Kubernetes on GCP) to establish mTLS with a backend, and demos show short‑lived X.509 certs (≈5‑hour… | ||
| Tutorial: Sailing the Security Seas with Tetragon | Duffie Cooley | 01h 12m |
Hands-on walkthrough of Tetragon using the tetra CLI and an Instruqt single-node kind lab, installing via the Cilium Helm repo and relying on kernel BTF for… | ||
| From Risks to Resilience: Leveraging CNCF Projects Against Kube... | Alireza Rahmani, Hilliary Lipsig | 38m |
Maps each OWASP Kubernetes Top 10 risk to specific CNCF tools and shows a decision path applied to a small AI startup that picks options to minimize learning… | ||
| Implementing AI RMF with Policy-as-Code Automation | Robert Ficcaglia, Anca Sailer, Vikas Agarwal | 35m |
Maps Linux Foundation principles to NIST AI RMF and ships machine-readable controls plus working templates that enforce checks at CI/CD and Kubernetes… | ||
| nothing matches | ||