[Initiative] Security Slam 2024

[eddie-knight]

What problem is this trying to solve?

Based on insights gathered from CLOMonitor, the majority of CNCF projects— including graduated projects— are underperforming on critical metrics that are statistically correlated to the presence of vulnerabilities in a project.

Due to a focus on feature prioritization or other difficulties, security hygiene is regularly sacrificed by overworked project maintainers.

How does this attempt to solve the problem?

1. Create a time-boxed period where all CNCF projects are encouraged to make a small set of improvements
2. Create a digital space for projects to share knowledge and resources related to the event goals
3. Create a digital and/or physical space for contributors and maintainers to work on the most sensitive or under-supported projects
4. Provide a long-tail incentive for projects to make these changes, especially by broadcasting the achievements made by projects

What is the status of this initiative?

Tasks

Beta Give feedback

1. Determine a STAG Representative: @jkjell
2. Determine a Project Lead who is not the STAG rep: @eddie-knight
3. Establish key partnerships, such as other CNCF TAGs or CNCF Staff
4. Create a landing zone for initiative documentation and outputs
5. Document a sequential plan, including event preparation, execution, and followup

[eddie-knight]

Estimated timeline (WIP):

1. Now through Nov 12: Set expectations with projects, prepare materials, create solution patterns, etc
2. Nov 12 - Dec 12: TAG Security to provide a unique value to projects related to security hygiene
3. Dec 12 - ?: TAG Security to provide a unique value to Kubernetes subprojects related to security hygiene

[eddie-knight]

Unique value added in previous events, based on feedback from Argo and OpenFGA:

1. Space for projects to discuss and share knowledge as they make the same set of improvements at the same time
2. Recognition for security hygiene improvements

The planning team agreed that it would be nice to have additional feedback from past participants regarding the unique value added.