cncf/tag-security

Cloud Native Security Map (Landscape v2)

lumjjb opened this issue · 27 comments

lumjjb commented

Description:

Provide a different view of a security landscape which will provide more useful information

Impact:

The current security landscape is a list of categories which are useful for an overview. We want to provide an alternative view of the landscape which can be consumable by security practitioners, executives, and users of security.

Scope:

Create a visual landscape of multiple processes, "Creating a cloud native app", "Setting up a cloud native infrastructure", "monitoring, logging, remediation and alerting in cloud native". Each process would be decomposed to several steps and sub-processes. Each of which will detail information about relevant threats, examples and mitigations.

EDIT: from whitepaper discussions: The landscape should mirror the topics of the whitepaper, and provide a visual guide and act as a tool for practitioners to find the correct tools to help them.

TO DO

stale commented

This issue has been automatically marked as inactive because it has not had recent activity.

lumjjb commented

Here is a mockup that we've worked on, I'd like to be able to put this in an interactive web format.

https://drive.google.com/file/d/1sIBxUT1ohmQCzR_ms4OpJ_GAh96IEjZX/view?usp=sharing

If anyone has some expertise doing web work, would be great to get additional eyes on this!

yeelinglam commented

@lumjjb - I could give this a try, please provide a bit more around how "interactive" you would like. Also, do you want it to be hosted on Github or is there a target web hosting place?

lumjjb commented

Awesome - I think we can work with the assumption that we can have other hosting. We can ask for some resources from the CNCF in that regard.

I found this example that I really liked as part of gojs library (although I think we can't use it because its a commercial library). https://gojs.net/latest/intro/events.html (look at the first example of the page, where each word is clickable).

Having the diagram with the flow on the top and whenever you click on one of the items, the description would just appear at the bottom of the diagram. The content would look something like this (ignore the words in the diagram at the top - those should just be each individual step) https://sig-security-scenarios.netlify.app/commits/

Clicking on one of the boxes in the flow would lead to the bottom updating with the details of that box. It would be added bonus to having nice navigation of the diagram.

I may not be very good with articulating what I'm thinking graphically, so if you'd like we can jump on a call to chat.

yeelinglam commented

@lumjjb - sure, most evenings are open for me, please send meeting invite to yeeling.lam@gmail.com - we could give Google Meet a try if you like ;)

lumjjb commented

Great! I'll send you an invite. Let me know if another time is better.

TheFoxAtWork commented

@lumjjb regarding #297 : is the expectation that the landscape can indicate which projects have multi-factor authentication? We could also add it as a item in the final assessment report where we go over over recommendations?

stale commented

This issue has been automatically marked as inactive because it has not had recent activity.

lumjjb commented

Now that the whitepaper is completed, we can resume work on the Landscape, which provides a practical/tooling side to the concepts highlighted in the whitepaper.

dcomas commented

@lumjjb let me know if I can help on this one, as you mentioned this issue in the CNCF meeting and I think I can contribute. :)

  • 👍1
jlisbz commented

Great, please count me in too if you need some help on this landscape development.

  • 👍1
TheFoxAtWork commented

samesies!

chasemp commented

Interested. :)

lumjjb commented

We will be having a kick-off meeting for the security landscape next Wednesday (13 January at 12pm EST / 9am PST). Going to send out an invite - email me at (LUMJJB@gmail.com) if you did not get the invite.

@dcomas i am not able to see your email, could you ping me. tks

@PushkarJ saw your note in the channel, seems like you're interested, ping me your email if you'd like to join as well

  • 👍2
ashutosh-narkar commented

Please add me as well !

lumjjb commented

Agenda for SIG Security “Landscape” kick-off meeting (covering 1-4)

1. Goals and Non-goals of SIG-Security “Landscape”

  • Provide a mapping of CNCF and open source projects to areas of CN Security whitepaper
  • Provide a practical viewpoint and information on topics in the CN Security whitepaper
  • Identify gaps in CN Security in the ecosystem and make recommendations to TOC
  • Help educate practitioners of what technologies can be used in practice and how they tie into each other
  • Provide practical tips or examples for how to use tools within this category, or why they are important (I.e. example breaches, etc.)
  • Provide a reference for frameworks to utilize when developing CN Security solutions and architectures.

Non-goals:

  • Not an implementation guide on how to implement CN Security
  • Not a checklist of what to do
  • Not one technology focused (i.e. not taking 1 reference architecture and developing the landscape around it).

2. Naming of SIG-Security “Landscape”

Make suggestions and bring ideas to community

Suggestions

  • e.g. 1

4. Organization of SIG-Security Landscape

  • Propose several ideas on what to do, individuals/groups sign up to propose ideas at next meeting

Example A. Overview of white paper, click into different categories for details and projects. For each header/sub-header, provide relevant links to other aspects that people may wish to pursue. I.e. for signing of artifacts, relevant, would be the various aspects of signing and also linking to runtime, because there is a verification enforcement. This way users can explore cloud native security in a more holistic way.

5. Content of Security Landscape (Future)

  • Develop and split up content creation in the future
  • 👍1
JonZeolla commented

Was the meeting recorded or are there any minutes?

magnologan commented

@JonZeolla please check here for meeting notes: https://docs.google.com/document/d/170y5biX9k95hYRwprITprG6Mc9xD5glVn-4mB2Jmi2g/edit?usp=drive_web&ouid=112152877013556173105

For any other questions, feel free to reach out to us on our Slack: cloud-native.slack.com

  • 👍1
lumjjb commented

@JonZeolla join the #sig-security-geography channel on slack to join in the discussion

  • 👍2
TheFoxAtWork commented

This project needs at least 1 non SIG leadership lead to help guide this forward!

ragashreeshekar commented

Please add me to this initiative as well
@TheFoxAtWork

ashutosh-narkar commented

@ragashreeshekar please join the #sig-security-whitepaper-map channel on slack to join other folks working on this.

ragashreeshekar commented

@ragashreeshekar please join the #sig-security-whitepaper-map channel on slack to join other folks working on this.

Thanks @ashutosh-narkar. I've joined the channel :)

  • 👍1
lumjjb commented

Status:

ashutosh-narkar commented

Closing this in favor of #737.