The State of Vulnerability in Cloud Native Security
summary
Aggregates 40+ CNCF security audit PDFs into a searchable GitHub repo and parses 40+ audit PDFs into a GitHub repo to extract 1) audit findings and 2) third‑party dependency results. Uses Snyk to scan dependencies and finds Kubernetes has more than double the reported vulnerabilities of the runner‑up, data‑validation bugs are the largest class, most issues are low/medium with very few criticals, and at least one dependency shows a critical CVE. Recommends yearly audits, public bug bounties, and posting findings as GitHub issues for traceable fixes.
AI-written summary · about
chapters (16)
- 0:00Intro
- 2:53Disclaimer
- 3:39Awesome K8s Security List
- 4:40Project Idea
- 7:04CNCF Security Audits
- 8:55The State of Vulnerability - Methodol
- 10:42The State of Vulnerability - Analysis
- 11:27The State of Vulnerability - Results
- 12:10The State of Vulnerability - Projects
- 13:52The Top 10 Projects Projects
- 15:16The State of Vulnerability - Vuln Classe
- 16:15The State of Vulnerability - Severity
- 17:42Open Source Security - Dependencies
- 20:16Vulnerability Risks
- 20:56Recommendations for CNCF
- 23:47Next Steps
related talks
22mSecuring Kubernetes: Best Practices for DevSecOps in the Cloud-Native Era
14mInforming Cloud Native Vulnerability Management: Some Views from the Past
36mThe Devil in the Details: Kubernetes’ First Security Assessment
36mThe Devil in the Details: Kubernetes’ First Security Assessment
15mA Special Interest in Cloud Native Security
20m5 Open Source Cloud Native Security Tools
45mInsights from the Cloud Native Security Slam
29mHarder than You Think: Native Security in Kubernetes