Level up Your Security Career with the TAG Security Community
summary
TAG Security performs hands‑on security assessments for CNCF projects (Flux, Kubeflow, Flatcar), producing joint assessment reports, threat models and whitepapers; recent outputs include a Flatcar joint assessment that dug into build infrastructure, signing, update framework and immutable partitions, found no smoking‑gun compromises and produced merged guidance toward graduation. Processes use rapid risk checks and STRIDE walkthroughs, weekly timezoneed meetings and public GitHub repos, and publications like the Secure Software Factory and a fuzzing handbook to harden supply chains and clarify supply chain attestations and threat model expectations.
AI-written summary · about
chapters (17)
- 0:00TAG Security introduction
- 1:04TAG Security purpose
- 3:09Supply chain security focus
- 5:19Community meetings
- 7:06Recent assessments
- 9:57Projects and collaborations
- 10:59In-toto deep dive
- 11:40Publications and updates
- 13:05Threat modeling cloud apps
- 15:59Flatcar Linux threat modeling
- 20:34Flatcar Linux case study
- 25:08Build infrastructure analysis
- 27:39System security properties
- 30:11Joint assessment process
- 31:34Flatcar Linux graduation
- 33:27Join TAG Security
- 34:10Q&A
related talks
24mStaring Into the Abyss With the Security Technical Advisory Group
07mA Security Engineer’s Guide to TAG Security
30mThe Immediate and Lasting Benefits of TAG Security Assessments
19mTAG Security Cloud Native Security Whitepapers Overview
05mA Maintainer’s Tour Of Tag Security And Compliance
32mStaring Into the Abyss with the Security Technical Advisory Group
40mCreating Cloud Native Security
17mA Sneak Peak Into Security Reviews with the Community