Brandon Lum
where else to find them
bluesky:lumjjb.bsky.social
x:lumjjb
what they talk about
all 4 in the filters
where they keep going back
- KubeCon + CloudNativeCon North America4 editions2019–2022
- KubeCon + CloudNativeCon China2 editions2018–2019
all 13 in the filters
on a stage with
all 12 in the filters
who talks about the same things
- Adrian Mouat20 talks
- Frederick Kautz27 talks
- John Kjell16 talks
- Andrew Martin50 talks
- Dan Lorenc21 talks
- Matt Jarvis15 talks
| title | conference | date |
|---|---|---|
| Keynote: Keep Calm and Keep Coding: How To Not Panic When Big CVEs Drop | KubeDay Singapore 2023 | 2023-12-12 |
When a major CVE drops the concrete steps are: inventory everything, generate SBOMs, ingest them into GUAC to build a dependency knowledge graph, and query it… | ||
| Keynote: The Next Steps in Software Supply Chain Security | CloudNativeSecurityCon North America 2023 | 2023-02-01 |
Industry builds strong provenance: SLSA and Tekton produce rich SBOMs and attestations, and standards like SPDX and CycloneDX plus VEX are arriving. The… | ||
| Keynote: Closing Remarks | CloudNativeSecurityCon North America 2023 | 2023-02-01 |
Announcement enforces an event code of conduct and says violations go to registration; organizers explicitly enforce inclusion. Conference thanks sponsors for… | ||
| Keynote: Closing Remarks | CloudNativeSecurityCon North America 2023 | 2023-02-01 |
Conference wraps with gratitude for an in person program that grew over two days and a concrete set of next steps: a tech security meet up happens during lunch… | ||
| SBOM X-Ray Superpowers: Making Better SBOMs, Using SBOMs | KubeCon + CloudNativeCon North America 2022 | 2022-10-24 |
Demonstrates a producer-driven workflow that attaches SBOMs to artifact SHA256 fingerprints, records attestations in the Rekor transparency log and uses… | ||
| Welcome & Opening Remarks | Global Security Vulnerability Summit @ Open Source Summit North America 2022 | 2022-06-23 |
Opening remarks set summit goals: coordinate working groups and BoFs to turn proposals into action, not just talk. Notes that vulnerabilities evolve from… | ||
| Road to SLSA3: Non-falsifiable Provenance in Tekton with SPIFFE/SPIRE | SupplyChainSecurityCon at Open Source Summit North America 2022 | 2022-06-21 |
Build pipeline Tekton integrates SPIFFE/SPIRE and Tekton Chains to reach SLSA level 3 by making provenance non-falsifiable: each taskrun pod receives an SVID… | ||
| Closing + CTF Wrap Up | Cloud Native SecurityCon Europe 2022 | 2022-05-16 |
Community announces new guidance and papers (secure software factory reference architecture, supply chain best practices, SBOM guidance, NIST mappings) and… | ||
| Staring Into the Abyss with the Security Technical Advisory Group | KubeCon + CloudNativeCon Europe 2022 | 2022-05-16 |
Security TAG outlines concrete artifacts and next steps: a revised v2 white paper with a ransomware and EU compliance section, a secure software factory… | ||
| Creating Cloud Native Security | KubeCon + CloudNativeCon North America 2021 | 2021-10-11 |
Tech Security TAG defines concrete outputs not vague theory: a white paper and an interactive security map (desktop-only) that maps controls to tools, a living… | ||
| Event Wrap Up | Cloud Native Security Day North America 2020 | 2020-11-17 |
Cloud Native Security SIG reports five completed security assessments, each scoped to about security assessments (2–4 weeks) with roughly two weeks of active… | ||
| A Special Interest in Cloud Native Security | KubeCon + CloudNativeCon North America 2020 Virtual | 2020-11-17 |
SIG Security publishes a 36-page white paper that defines cloud-native security layers, maintains a supply chain catalog of real compromises with threat… | ||
| Closing Remarks | Cloud Native Security Day Europe 2020 | 2020-08-17 |
Find repos and issues at github.com/cncf/security and join the Slack channel for action items. Ongoing security assessments run about three weeks with four to… | ||
| Adventures in Production with GitOps, Secure Pipelines & Compliance - Brandon Lum & Ricardo Aravena | Kubernetes Forum Sydney 2019 | 2019-12-12 |
A concrete pipeline shows GitOps with security wired in: a Tekton CI on a local cluster clones a Flask repo, runs Python Safety static checks, builds a… | ||
| Adventures in Production with GitOps, Secure Pipelines & Compliance | Kubernetes Forum Seoul 2019 | 2019-12-09 |
A Tekton pipeline on Minikube builds a Python Flask app, running python-safety and hadolint, containerizes it, runs a Trivy image scan, then encrypts the image… | ||
| CNCF SIG-Security Intro | KubeCon + CloudNativeCon North America 2019 | 2019-11-18 |
CNCF SIG‑Security runs a specific security assessment process that produces a prioritized recommendations list (not a line‑by‑line code audit), using a… | ||
| Protecting Sensitive Code with Encrypted Container Images on... | KubeCon + CloudNativeCon + Open Source Summit China 2019 | 2019-06-24 |
Build-time encryption of container layers uses a symmetric blob plus per-recipient wrap keys so the same encrypted layer can be shared and still grant… | ||
| Protecting Sensitive Code with Encrypted Container Images on... | KubeCon + CloudNativeCon China 2019 | 2019-06-24 |
Prototype encrypts OCI image layers, pushes encrypted blobs plus per-recipient wrap key entries, and runs decryption on node side via containerd so registry… | ||
| Nabla Containers: A New Approach to Container Isolation | KubeCon + CloudNativeCon China 2018 | 2018-11-13 |
Nabla containers lift many kernel services into user space using library-OS/unikernel techniques and a custom runnc OCI runtime, producing a special Nabla… | ||
| nothing matches | ||