131f6d50c9
* Proposed charter for SIG Security Letter to Steering committee to be linked later. * Update wg-security-audit/sig-security-charter-proposal.md Co-authored-by: Micah Hausler <micahhausler@users.noreply.github.com> * Accept nested list modification Co-authored-by: Micah Hausler <micahhausler@users.noreply.github.com> * Adding README created by community make. Adding sig-security to sigs.yaml Creating sig-security/ and moving proposed charter to that directory. * Proposed charter for SIG Security Letter to Steering committee to be linked later. * Update wg-security-audit/sig-security-charter-proposal.md Co-authored-by: Micah Hausler <micahhausler@users.noreply.github.com> * Accept nested list modification Co-authored-by: Micah Hausler <micahhausler@users.noreply.github.com> * Correct capitalization Co-authored-by: Nikhita Raghunath <nikitaraghunath@gmail.com> * resolved merge conflict I don't think we need to use an entirely separate GOPATH, thus forcing us to re-download modules every time we run `make` This was causing verify-generated-docs to fail locally since go will set its modcache as readonly and thus cause the cleanup "rm -rf" in this script to fail. In go1.14 or later we could use "-modcacherw" to stop making the modcache readonly but that bring me back to.. why do need an entirely separate GOPATH in the first place? * Corrected employers Co-authored-by: Micah Hausler <micahhausler@users.noreply.github.com> Co-authored-by: Nikhita Raghunath <nikitaraghunath@gmail.com> |
||
|---|---|---|
| .. | ||
| ancillary-data | ||
| findings | ||
| Atredis and Trail of Bits Proposal.pdf | ||
| OWNERS | ||
| README.md | ||
| RFP.md | ||
| RFP_Decision.md | ||
README.md
Security Audit Working Group
Perform a security audit on k8s with a vendor and produce as artifacts a threat model and whitepaper outlining everything found during the audit.
Stakeholder SIGs
- SIG Auth
Meetings
- Regular WG Meeting: Mondays at 12:00 PT (Pacific Time) (weekly). Convert to your timezone.
Organizers
- Aaron Small (@aasmall), Invitae
- Craig Ingram (@cji), Stripe
- Jay Beale (@jaybeale), InGuardians
- Joel Smith (@joelsmith), Red Hat
Contact
Published Documents
Trail of Bits and Atredis Partners, in collaboration with the Security Audit Working Group, have released the following documents which detail their assessment of Kubernetes security posture and their findings.
Findings
Ancillary Data
Mailing Lists
- Sensitive communications regarding the audit should be sent to the private variant of the mailing list.
Request For Proposals
The RFP was open between 2018/10/29 and 2018/11/30 and has been published here.
Vendor Selection
The RFP is now closed. The working group selected Trail of Atredis, a collaboration between Trail of Bits and Atredis Partners to perform the audit.
You can read more about the vendor selection here.