Insights from the Cloud Native Security Slam

## Overview

This presentation covers insights from the Cloud Native Security Slam, a CNCF-organized event designed to foster collaboration among projects to improve security hygiene. The speaker, from Sonatype, presents findings from 11 months of automated security checks tracked across 163 CNCF projects using CloneMonitor, a tool that runs a subset of OpenSSF Scorecard checks.

## Key Findings

The data reveals striking patterns:

- **Maturity Paradox**: Graduated (stable) CNCF projects score 65–75% on security hygiene—worse than many sandbox and incubating projects, despite graduated status implying higher standards. - **Security Slam Effect**: Projects that voluntarily participated in the security slam maintain consistently high scores (85%+) across all nine tracked checks, demonstrating sustained improvement. - **Critical Signature Gap**: Less than 25% of all CNCF projects provide release signatures for provenance validation; even among graduating projects, less than half comply. This undermines end-user ability to verify software authenticity. - **SBOM Concentration**: Half of all SBOMs in the CNCF ecosystem were generated by security slam participants, showing the impact of focused improvement efforts.

## Nine Security Checks

CloneMonitor evaluates: (1) binaries in source code (>75% pass), (2) CI/CD pipeline security (~75% pass, but 20–25% of incubating projects fail), (3) dependency management (trending upward, sandbox projects leading), (4) CI/CD permissions (only 60% of graduating projects secure), (5) security disclosure policies (unexpectedly high for sandbox), (6) branch protection (~75% overall, incubating only ~50%), (7) code maintenance (strong across ecosystem), (8) SBOM publication (major gap, <50%), and (9) release signatures/provenance (critical failure, <25%).

## Broader Context

Sonatype's annual supply chain security research (eighth annual report shown; ninth imminent) finds that end-user secure consumption of open source—including dependency management and provenance validation—has shown zero year-over-year improvement, despite increased awareness and tooling.

## Prioritization Framework

The speaker emphasizes evaluating security work using both importance (how many bad actors would it stop) and current ability to implement. Organizations often defer critical work when key people are unavailable; instead, teams should tackle important-but-achievable items.

## 2024 Security Slam Goals

The upcoming event (October 10–November 7) targets five improvements: 1. **End-user documentation**: Incentivizing secure consumption practices 2. **SBOM automation**: Addressing regressions through automated tooling 3. **Indirect improvements**: Rewarding licensing, documentation, and legal statements 4. **Project tracking**: Ensuring all projects appear in monitoring systems 5. **Self-assessments**: Testing the hypothesis that explicit security thinking drives better decisions

Tools like GoReleaser now include SBOM generation by default, and recently merged pull requests add cross-references between scorecard and renovate-bot, improving ecosystem interconnectedness. The speaker calls for increased awareness and championing of these practices to boost participation beyond current volunteers.