[Assessment] Cloud Custodian

[kapilt]

Project Name: Cloud Custodian

Github URL: https://github.com/cloud-custodian/cloud-custodian

Security Provider: yes, although its often used independently from security concerns, for many users its part of their security tooling.

• Identify team
  • SIG Leadership Representative: Ash Narkar (@ashutosh-narkar)
  • Project security lead (@kapilt)
  • Lead Security Reviewer - ( @rficcaglia )
  • 1 or more additional reviewer(s) (@IAXES, @chasemp, @itaysk, @ultrasaurus, @TheFoxAtWork )
  • Declaration of reading of security reviewer guidelines and declaration of conflicts (by each reviewer)
  • Sign off by chairs on reviewer conflicts (@lumjjb)
• Create slack channel #sec-assessment-custodian
• STAG Lead Joint Assessment document
• "Naive question phase" Lead Security Reviewer asks clarifying questions
• Initial review
• Presentation & discussion
• Share draft findings with project
• Assessment summary and doc checked into /assessments/projects/project-name
• CNCF TOC presentation (if requested by TOC)

older self-assessment document

[rficcaglia]

will raise hand to be a reviewer but due to time constraints cannot be lead on this one, sorry!

edit: no conflicts AFAIK

[johnmark]

thanks - where else can/should we enlist reviewers?

[JustinCappos]

I'll volunteer to review too.

@ashutosh-narkar , would you be able to participate as a reviewer? I think your perspective would be very helpful.

We can find someone else to lead.

[ashutosh-narkar]

Sure @JustinCappos, I would be happy to be a reviewer.

[rficcaglia]

EDIT: markdown strikethrough not cooperating... Falco seems to be ready to go so I'll have to revert to reviewer instead of the lead. sorry!

…

On Sat, Dec 14, 2019 at 2:28 PM Ashutosh Narkar ***@***.***> wrote: Sure @JustinCappos <https://github.com/JustinCappos>, I would be happy to be a reviewer. — You are receiving this because you commented. Reply to this email directly, view it on GitHub <#307>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAGENIQXJ2SF67Q4VMI4AP3QYVMXZANCNFSM4JZT4WLQ> .

[JustinCappos]

Okay, I'll let @ultrasaurus weigh in on priorities, likely after getting TOC guidance.

[johnmark]

thank you - wait, isn't Falco already a sandbox project? In which case, haven't they already gone through some assessment?

Just curious - what is the bar to becoming a sandbox project? - @ultrasaurus

[rficcaglia]

Falco did a code audit via the TOC before this SIG had established any assessment process. The idea though is that the SIG assessment would be complimentary to, and not a substitute for, a code audit (or operational pen test, or in situ vulnerability assessment, etc). As Sarah and others have articulated elsewhere, the scope of the SIG assessment is more around threat model, default secure configuration options, and project team capabilities and values to maintain secure design and implementation practices over time....rather than a snapshot point-in-time audit. Or at least that’s how I see it. Falco still has yet to complete the SIG assessment. OPA was already sandbox when they underwent this SIG assessment process. You can discuss with them the perceived or actual benefits of the process, and overall feedback. I presume they would also have some suggestions on how to efficiently complete the process, too. The sig assessment is not current a requirement for any CNCF milestone. That is under discussion with the TOC as I understand. Some of us (at least one of us ;) think it should be, or at the very least accelerate acceptance or focus resources on those who do voluntarily complete it, especially security-oriented projects.

…

On Sun, Dec 15, 2019 at 7:22 AM John Mark ***@***.***> wrote: thank you - wait, isn't Falco already a sandbox project? In which case, haven't they already gone through some assessment? Just curious - what is the bar to becoming a sandbox project? - @ultrasaurus <https://github.com/ultrasaurus> — You are receiving this because you commented. Reply to this email directly, view it on GitHub <#307>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAGENIRIGHXTUF4U4EYMT2LQYZDT3ANCNFSM4JZT4WLQ> .

[johnmark]

Thank you for the context - that is helpful.

[rficcaglia]

as reviewer here is my conflict declaration:

Hard conflicts:
Reviewer is a maintainer of the project - NO
Reviewer is a direct report of/to a maintainer of the project - NO
Reviewer is paid to work on the project -NO
Reviewer has significant financial interest directly tied to success of the project - NO

Soft conflicts:

Reviewer belongs to the same company/organization of the project, but does not work on the project - NO
Reviewer uses the project in his/her work - NO
Reviewer has contributed to the project. - NO
Reviewer has a personal stake in the project (personal relationships, etc.) - NO

[steven-hadfield]

I'm open to be a reviewer as well, although I would not be able to be lead due to a soft conflict.

Hard conflicts:
Reviewer is a maintainer of the project - No
Reviewer is a direct report of/to a maintainer of the project - No
Reviewer is paid to work on the project - No
Reviewer has significant financial interest directly tied to success of the project - No

Soft conflicts:
Reviewer belongs to the same company/organization of the project, but does not work on the project - No
Reviewer uses the project in his/her work - Yes
Reviewer has contributed to the project. - Pending
Reviewer has a personal stake in the project (personal relationships, etc.) - No

[rficcaglia]

@ericavonb I think was maybe willing/able to volunteer as lead, and I said I'd help her through the process...that was discussed pre-holidays on the last Policy WG call, so not sure if she has had time to reconsider and run away (Monty Python skit comes to mind ;) )

[ericavonb]

I'm open to be a reviewer. Here is my conflict declaration:

Hard conflicts:
Reviewer is a maintainer of the project - NO
Reviewer is a direct report of/to a maintainer of the project - NO
Reviewer is paid to work on the project -NO
Reviewer has significant financial interest directly tied to success of the project - NO

Soft conflicts:

Reviewer belongs to the same company/organization of the project, but does not work on the project - NO
Reviewer uses the project in his/her work - NO
Reviewer has contributed to the project. - NO
Reviewer has a personal stake in the project (personal relationships, etc.) - NO

[JustinCappos]

Hard conflicts:
Reviewer is a maintainer of the project - NO
Reviewer is a direct report of/to a maintainer of the project - NO
Reviewer is paid to work on the project -NO
Reviewer has significant financial interest directly tied to success of the project - NO

Soft conflicts:

Reviewer belongs to the same company/organization of the project, but does not work on the project - NO
Reviewer uses the project in his/her work - NO
Reviewer has contributed to the project. - NO
Reviewer has a personal stake in the project (personal relationships, etc.) - NO

[JustinCappos]

We need a lead reviewer. @ericavonb Would you be willing to take on this role?

[ericavonb]

@JustinCappos we discussed at the last sig-security meeting that it would be best if someone who was on a previous security review could take the lead. Wdyt?

cc @rficcaglia @ultrasaurus

[JustinCappos]

That only really leaves @ashutosh-narkar, I think. Ash, are you willing to do this?

[ashutosh-narkar]

Hello @JustinCappos, I would like to get some experience in the reviewer role before leading a review. I would more comfortable leading the next one. Hope that's fine.

[JustinCappos]

Okay. @ericavonb , I'd be happy to have you lead this. I understand the concern about not having done this, but you can rely on @rficcaglia, @ultrasaurus, and me to help out if you have questions / problems. Are you comfortable taking the lead role with us supporting?

[rficcaglia]

Yes I’m definitely happy to help!

…

On Fri, Jan 17, 2020 at 8:59 AM Justin Cappos ***@***.***> wrote: Okay. @ericavonb <https://github.com/ericavonb> , I'd be happy to have you lead this. I understand the concern about not having done this, but you can rely on @rficcaglia <https://github.com/rficcaglia>, @ultrasaurus <https://github.com/ultrasaurus>, and me to help out if you have questions / problems. Are you comfortable taking the lead role with us supporting? — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#307>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAGENIUYLJ6VOGDT23ESPCDQ6HBWBANCNFSM4JZT4WLQ> .

[ultrasaurus]

I think it is important to have someone in the lead role who run the process before -- from a SIG-Security perspective, we're not just working on this assessment. We're also testing the process. (This will be # 5 of our FIRST FIVE #167).

Of our experienced reviewers, @rficcaglia is leading Falco, @lumjjb is leading SPIFFE/SPIRE. looping in @justincormack to see if he might be open to leading this one.

[ashutosh-narkar]

Hard conflicts:

Reviewer is a maintainer of the project - NO
Reviewer is a direct report of/to a maintainer of the project - NO
Reviewer is paid to work on the project - NO
Reviewer has significant financial interest directly tied to success of the project - NO

Soft conflicts:

Reviewer belongs to the same company/organization of the project, but does not work on the project - NO
Reviewer uses the project in his/her work - NO
Reviewer has contributed to the project. - NO
Reviewer has a personal stake in the project (personal relationships, etc.) - NO

[bdaw]

Hard conflicts:

Reviewer is a maintainer of the project - NO
Reviewer is a direct report of/to a maintainer of the project - NO
Reviewer is paid to work on the project - NO
Reviewer has significant financial interest directly tied to success of the project - NO

Soft conflicts:

Reviewer belongs to the same company/organization of the project, but does not work on the project - NO
Reviewer uses the project in his/her work - NO
Reviewer has contributed to the project. - NO
Reviewer has a personal stake in the project (personal relationships, etc.) - NO

[justincormack]

I could lead this, and mentor @ericavonb if that works better.

[JustinCappos]

I could lead this, and mentor @ericavonb if that works better.

Great! @justincormack Would you kindly post your conflict statement?

[justincormack]

Hard conflicts:
Reviewer is a maintainer of the project - No
Reviewer is a direct report of/to a maintainer of the project - No
Reviewer is paid to work on the project - No
Reviewer has significant financial interest directly tied to success of the project - No

Soft conflicts:
Reviewer belongs to the same company/organization of the project, but does not work on the project - No
Reviewer uses the project in his/her work - Not at present, it is something we are considering
Reviewer has contributed to the project. - No
Reviewer has a personal stake in the project (personal relationships, etc.) - No

[jlk]

one more -

as reviewer here is my conflict declaration:

Hard conflicts:
Reviewer is a maintainer of the project - NO
Reviewer is a direct report of/to a maintainer of the project - NO
Reviewer is paid to work on the project -NO
Reviewer has significant financial interest directly tied to success of the project - NO

Soft conflicts:
Reviewer belongs to the same company/organization of the project, but does not work on the project - NO
Reviewer uses the project in his/her work - NO
Reviewer has contributed to the project. - NO
Reviewer has a personal stake in the project (personal relationships, etc.) - NO

[rficcaglia]

/assign @lumjjb

[IAXES]

Hard conflicts:
Reviewer is a maintainer of the project - NO
Reviewer is a direct report of/to a maintainer of the project - NO
Reviewer is paid to work on the project -NO
Reviewer has significant financial interest directly tied to success of the project - NO

Soft conflicts:

Reviewer belongs to the same company/organization of the project, but does not work on the project - NO
Reviewer uses the project in his/her work - NO
Reviewer has contributed to the project. - NO
Reviewer has a personal stake in the project (personal relationships, etc.) - NO

-Matthew

[sunstonesecure-robert]

Hi All! So the Doodle poll best option was tomorrow (Tues) Jul 13 7:00 AM- 7:30 AM Pacific...unfortunately not everyone could make it, but, the next best option was the 7:30AM-8AM Pacific slot so I will stay on the line for the full hour and merge in everyone's feedback. Join the usual TAG zoom

[IAXES]

Good day,

I'll bring this up during tomorrow's general meeting, but in the meantime:

Calling for reviewers :)

We could especially use some eyes on the "Threat Model" section. Document link/bookmark: https://docs.google.com/document/d/1IbrFNz2lIICema0NfF27HflzsMcTQGxH22SubLUM47I/edit#bookmark=id.1ci93xb

Thank you!

[lumjjb]

Hi @IAXES , @rficcaglia , trying to understand the ask for reviewers, is this an issue of too big a scope, and we need more reviewers, or do we need a reviewer with a specific expertise/skillset?

Tagging @rohitkhare

[sunstonesecure-robert]

mostly more bodies :) right now it is just Matthew and Chase and myself. having another set of eyes, or two, especially from more kubernetes operators or non-AWS operators would be ideal.

…

On Wed, Jul 28, 2021 at 10:45 AM Brandon Lum ***@***.***> wrote: Hi @IAXES <https://github.com/IAXES> , @rficcaglia <https://github.com/rficcaglia> , trying to understand the ask for reviewers, is this an issue of too big a scope, and we need more reviewers, or do we need a reviewer with a specific expertise/skillset? — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#307 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AQWTGFD6VKCGNYOIZ5WAAN3T2A62XANCNFSM4JZT4WLQ> .

[lumjjb]

Hmm, based on the issue history, looks like a ton of reviewers expressed interest early in the year, lets reach out to them

[TheFoxAtWork]

I'll schedule time to deep dive on it next week, apologies for my tardiness. If there is a particular area requiring explicit attention please make me aware

[sunstonesecure-robert]

the recorded Zoom session from yesterday was a good start on the threat model - but definitely AWS specific - would be nice to have Azure or GCP - and ideally Kube.

…

On Wed, Jul 28, 2021 at 11:01 AM Matthew Giassa ***@***.***> wrote: I'll schedule time to deep dive on it next week, apologies for my tardiness. If there is a particular area requiring explicit attention please make me aware The "Threat Model" section (IIRC) could use a broad perspective from multiple reviewers. — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#307 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AQWTGFDUXRMDIAGRW3BFPTTT2BAY7ANCNFSM4JZT4WLQ> .

[TheFoxAtWork]

Checking in here on a status, would someone update the issue and resolve the outstanding items on #786?

[castrojo]

We (c7n) owe Robert some updates to the assessment, we've prioritized getting this to him as soon as we can.

[IAXES]

We (c7n) owe Robert some updates to the assessment, we've prioritized getting this to him as soon as we can.

I believe we also need the final/canonical copy of the self-assessment document (in markdown format).

[lumjjb]

I sign off on conflicts declaration statements (for co-chair sign-off), with updated participants from the one initially done couple months ago.

[stale]

This issue has been automatically marked as inactive because it has not had recent activity.

[ashutosh-narkar]

Can we close this issue ? cc @sunstonesecure-robert @lumjjb