Insights from the Cloud Native Security Slam
Talkat Open Source Summit Europe 2023 · on Thursday, 2023-09-21· at 11:55· Room 0C (Floor 0), Abandoibarra Etorb., 4, 48011 Bilbao, Bizkaia, Spain·
summary
CNCF’s Security Slam brings 13 projects together to run a subset of OpenSSF Scorecard checks via CLOMonitor and accumulate 11 months of scorecard results across 163 repos (about 8,000 API calls). Slam participants consistently raise hygiene—binaries-in-source and CI/CD checks climb above 75%—while incubating projects lag and Kubernetes sits around 65–75%. SBOM publication and release signatures remain low (under ~50% and ~25% respectively). Renovate and other tools get concrete integrations; next Slam runs Oct–Nov 2023.
AI-written summary · about
chapters (9)
- 0:00Introduction
- 3:36Security hygiene challenges
- 5:02First Cloud Native Security Slam
- 12:29Results from hygiene improvements
- 21:59Communicating security policies
- 28:20Security hygiene trends summary
- 31:26Secure open source consumption
- 33:32Next Security Slam plans
- 37:06Q&A
related talks
45mInsights from the Cloud Native Security Slam
08mClosing Remarks
26mAn Introduction to Cloud Native Security
33mEvent Wrap Up
34mCNCF SIG-Security Intro
27mAn Open Book Test: Securing Open Source Software With OpenSSF’s Scorecard
27mHow Do You Trust Your Open Source Software?
34mIntro: CNCF Security SIG – Sarah Allen & Jeyappragash Jeyakeerthi