Understanding Security In The Cloud Native World

### Overview In this interview recorded at KubeCon, host Swapnil Bhartiya speaks with Brandon Lum, co-chair of the CNCF Security Technical Advisory Group (TAG). The discussion focuses on findings from a CNCF security micro-survey, how cloud-native security contrasts with traditional IT approaches, and the key initiatives the CNCF Security TAG is undertaking to help organizations overcome cultural and technical adoption hurdles.

### Key Topics - **Shifting From Traditional IT to Cloud-Native Security**: Moving beyond legacy concepts like endpoint security, cloud-native requires shifting left, establishing zero trust, authenticating controls, and attesting components across distributed microservices. - **The Tooling and Expertise Gap**: While interest in security is high, organizations are often overwhelmed by tooling choices and hindered by a lack of in-house expertise, with 12% of survey respondents reporting no plans to modernize their security. - **Cultural and Organizational Evolution**: The shift to shared responsibility in DevOps and new operational functions—such as cloud platform operators managing infrastructure-as-code cluster creation separately from traditional cluster administrators. - **Auditor and Compliance Misalignment**: Existing gaps between modern cloud-native methodologies and traditional security assessment or auditing practices.

### Technical Details & CNCF Initiatives - **Security Controls Mapping**: Ongoing work within the TAG to map compliance and risk management requirements directly to cloud-native technologies. - **White Papers and Guided Tours**: Educational resources covering domains such as supply chain security, image provenance, policy, runtime security, and anomaly detection. The group is developing an interactive Cloud Native Security Map with guided tours to help teams navigate white papers based on their specific priorities. - **Security Pals**: A mentoring initiative where security TAG members work directly with CNCF projects from the outset to embed secure defaults and formal vulnerability reporting processes. - **Certifications**: Collaboration with the Kubernetes community on programs like the CKS (referred to in discussion around Kubernetes security certification) to validate practical practitioner skills.

### Takeaways Cloud-native security is fundamentally an exercise in risk management rather than achieving absolute perfection. Organizations must identify their most critical assets and establish secure defaults early. Through open-source standardization, collaborative mentorship like Security Pals, and structured education, the CNCF aims to provide shared tooling and practical guidance to bridge the industry-wide security skills deficit.