Tag-security: Cloud Native Security Lexicon

[TheFoxAtWork]

Description: The TOC has requested a cloud native security lexicon that provides simple definitions, terms, and initial organizational use of those items. As the Cloud Native Ecosystem continues to grow we want to ensure all community members are have the same terms and definitions as well as an understanding about where they fit in their software development lifecycle as well as their operational environments.

Reference TOC meeting: https://www.youtube.com/watch?v=5q1EVccvR0U

Impact: There seems to be some confusion by the community on what some of these terms actually mean or imply. In some cases they are overloaded, used as a catch all, or misued. The Cloud Native Security Whitepaper has areas of each of these that would need rectified in a 2.0 update. Many of the cloud native projects perform multiple functions that span multiple terms and it is important that we clarify the items (terms) projects meet or achieve rather than generically lumping a project against an undefined or mis-defined concept (#565).

Scope: At a minimum, this lexicon will be maintained as a file in the repo and should include the following as a minimum:
user identity, service identity, secrets, keys, credentials. Each definition should be discussed and highlight the traits of that particular definition.

TO DO

• [x] SIG Leadership Rep: @TheFoxAtWork
• [x] Project leader(s) @ragashreeshekar
• [X] Project members: @MVrachev , @qnetter , @ragashreeshekar , @Adam88morris , @apmarshall , @matthewflannery , @bradmccoydev , @aspanner
• [X] draft document:https://docs.google.com/document/d/1n9wvEE6_lg3oFWMQGI7Pz0eRS05avMckNfuWctoQOkI/edit
• [X] Call for comments from the community - https://lists.cncf.io/g/cncf-tag-security/message/58
• [x] Public review Adjudication - June 5th
• [ ] PR for repo security-whitepaper/ in new folder definitions/
  
  
  
  • [ ] include README.md to discuss maintenance of the definitions. Refer to whitepaper and supply chain paper readmes
  
  
• [ ] Update STAG meeting to draw attention to the PR and allow for last round of review.
• [ ] Update TOC in next monthly meeting

Schedule:
Informal discussion : March 24
Kickoff : March 25
Identify the list of terms in scope : April 05
Initial definitions of the terms / link to authoritative definition sources : April 30
Review phase 1 : May 14
Review with wider audience : June 6
Finalization : June 13
TOC Review : June 27
Finalization and raise PR : Jul 4

[MVrachev]

Hi, I would like to help with this.
Should we use this issue to discuss the meaning behind each of the terms or slack channel?

[TheFoxAtWork]

@MVrachev I'd like to get a small group of folks to work on this. Once we have them confirmed we'll move the discussion into the Cloud Native Security Whitepaper Channel or another new Channel to tackle this. Thanks!

[qnetter]

I’d like to rejoin the SIG and collaborate on this.

[ragashreeshekar]

I'd like to collaborate on this

[Adam88morris]

I would be happy to be involved with this 👍

[apmarshall]

I’m game.

[ultrasaurus]

I think this came up at TOC meeting this week? Can someone who was there verify that and, if so, would be great to link to notes/video so whoever works on this can review the context and we can refer back if questions come up about the direction this ends up taking.

[TheFoxAtWork]

@ultrasaurus yep this came up in the TOC meeting this week! Updating.

[matthewflannery]

I'm up for this too @TheFoxAtWork

[bradmccoydev]

Happy to help also @matthewflannery

[aspanner]

I am keen, too.

[TheFoxAtWork]

Awesome!! I'll need someone to volunteer Project Lead, note this group spans multiple timezones so please take that into consideration.

[TheFoxAtWork]

@ragashreeshekar is working as project lead on this. Expect updates and to hear from her on next steps, schedule, collab space, etc.

[ragashreeshekar]

Hello folks, I request all the contributors to join the CNCF #sig-security-whitepaper Slack Channel - CNCF Sig-security-whitepaper channel. Here is the documentation Draft: CNCF Cloud Native Security Lexicon - this covers initial plan and tentative timelines. DM over slack with your mail address so I could add you as editors to the document. Feel free to connect with us for any queries.

[jralmaraz]

Keen to help on this as well, will ping you @ragashreeshekar , cheers!

[ragashreeshekar]

Hello folks, I request all the contributors to join the CNCF #sig-security-whitepaper Slack Channel - CNCF Sig-security-whitepaper channel. Here is the documentation Draft: CNCF Cloud Native Security Lexicon - this covers initial plan and tentative timelines. DM over slack with your mail address so I could add you as editors to the document. Feel free to connect with us for any queries.

Hello Folks, please join the slack channel and drop me a note so I could provide access to the document so you could join the initiative and start contributing