Tag-security: [Presentation] Software Factory

[justincormack]

Title: Software Factory

Speakers: Jonathan Meadows

Description: Building a secure automated software deployment factory with continous security. Open community discussion about contributing to common models and tooling.

Time: 20m

Availability: Any January meeting

TO DO

• [ ] SIG Representative
• [x] Schedule date: 13 Jan

[TheFoxAtWork]

Would Wednesday the 13th or 20th work?

[justincormack]

I believe 13th is good, will confirm by tomorrow.

[justincormack]

Confirmed for 13th.

[TheFoxAtWork]

added to agenda
~Emily Fox
@TheMoxieFox

On Mon, Jan 4, 2021 at 12:45 PM Justin Cormack [e-mail]
wrote:

Confirmed for 13th.

—
You are receiving this because you commented.
Reply to this email directly, view it on GitHub
https://github.com/cncf/sig-security/issues/501#issuecomment-754116619,
or unsubscribe
https://github.com/notifications/unsubscribe-auth/AH6IRKIUMXIBURK3M2PLANTSYH5DRANCNFSM4VTERY4Q
.

[jlk]

A link to slides would be handy...

[jonmuk]

Thanks everyone for the detailed discussions last night. We have several ideas and contributions to follow up on. The intent of the presentation was to request further collaboration as a group to tackle the supply chain problem, particularly around Software Factories. We're looking forward to tackling some hard problems!

We will be working with Justin Cormack and team to plan further sessions to socialise and discuss these ideas in the sig. Watch this issue for further updates and please reach out if people are interested in working with us on this.

Slides: Thoughts on Supply Chain Security (January 2021).pdf

Video of presentation: CNCF SIG Security 2021-01-13

[justincormack]

See #510 for followup working group proposal.

[aspanner]

Thanks for the presentation.
Can I please clarify slide 10: What is the purpose of tcb-1 which was described as a Kubernetes cluster running on someone's laptop?
What I'd like to understand is:
1) Wouldn't that make it inherently insecure as the laptop might be compromised
2) Couldn't the Makefile / IaC build the needed environments directly?
Thanks,
Andreas

[sublimino]

Hi @aspanner, thanks for the questions. Very briefly:

1. yes, any component might be compromised, and controls are required around any trusted/DR/bootstrap infrastructure. A laptop that can be locked in a safe may be slightly easier to secure, but this could be any trusted device

2. the TCB-1 is essentially building the software factory directly, except instead of re-implementing the pipelines using a makefile, it's using the same code, secrets integration, and orchestrator as the software factory. This provides some consistency/reusability, and is proposed as software factories are designed to build replicas of themselves.

All that said, we're in very early PoC stages so please do join a call to discuss further : ] #510 tracks the working group.

[aspanner]

Hi @sublimino, thank you for your quick response.

I am quite new here so apologies if you are working off a premise that I am not aware of.

1. I was checking out https://keylime.dev/ - perhaps that could be part of the bootstrap attestation
2. I am still not clear on the raison d'etre for tcb-1. My thinking is along the lines of runtime environments are harder to secure than code and code repos (but I might miss something vital here), however if I can secure say an Ansible script / Makefile from tampering & check before execution and re-building another instance then perhaps that would be more secure? Keen to get your thoughts.

I checked out the meeting calendar, unfortunately, 3 or 4 am is not a productive time for me :(