Knative Project Security Self-Assessment - Security Pals

[mayhumst]

What?

We are a team of four students at New York University. We have created an assessment for the knative project based on cncf's Security Self-Assessment Template and would like to put it forward for review. We are in contact with the security team at knative and are continuing to make edits to the assessment. (Team members: @Jabberwockiii @mushr00m-blue @ShambhaviSeth )

Why?

This assessment was the product of an assignment for a class with professor Justin Cappos, but we noticed that knative had no current assessment in the tag-security repository and would like to help fill this gap and make some security recommendations.

How?

This includes a current SBOM, a description of the product and its components/features, security goals and features, the deployment process, and recommendations for the documentation, among other sections.

Anything Else?

As previously mentioned, this assessment is a work in progress and all feedback is appreciated. We also hope to examine your threat model further and offer a few suggestions for revision in the next few days.

Additionally, I am cc'ing @evankanderson , with whom our team has been in contact with and has provided excellent initial feedback.

[netlify]

✅ Deploy Preview for tag-security canceled.

Name	Link
🔨 Latest commit	560ba19
🔍 Latest deploy log	https://app.netlify.com/sites/tag-security/deploys/65a802822f5bcb0008a9ec14

[eddie-knight]

Hi there! I'm just getting started looking at your pull request, and I noticed the DCO check is failing.

You can look at the checks section of the PR (I believe it should always be below the last comment) and look for a red X highlighting the failed check. In this case, you can click Details for more information about how to get that check passing.

[eddie-knight]

I noticed that you included an SBOM along with the self assessment. There are two reasons that jump to the front of my mind for why this isn't needed...

1. SBOMs should be associated with releases, as the bill of materials is only accurate and useful if it is created at build time and associated to a particular point in the code history.
2. If you need to link to an SBOM for some reason in the self-assessment, you can just provide a link out to the latest build artifacts that contain an SBOM.

We still have plenty more to review, but as a starter— could you please remove the SBOM from this PR?

[mayhumst]

Thank you @eddie-knight for the initial feedback! I have removed the SBOM from the project folder, and I hope the go.mod files are enough for the SBOM section in the metadata. I squashed the commits and signed them off, so the DCO check should be good now.

[ragashreeshekar]

Thanks for the PR @mayhumst and team, appreciate the efforts.
I have completed first pass of review and left several comments on section that needs your attention. Please feel free to reach out here or on slack for any questions and clarifications.

Along with addressing the comments, kindly update the PR branch with the latest content in the repo as this branch is out-of-date with the base branch.

[mayhumst]

@ragashreeshekar Thank you for detailed feedback! We've merged our branch to the parent repository, thank you for pointing that out. We've made a few initial changes based on your review and will fix the remaining issues quickly.

[mayhumst]

Hi @ragashreeshekar Thank you again for the feedback. My teammate has updated the actors and actions sections as of this morning. I hope it's a better representation of this project. We welcome additional feedback and look forward to hearing back about next steps.

[mayhumst]

Two additional files have been added to the folder: one for general recommendations, and one image of knative's component diagram.

We have updated the sections pointed out and hope the assessment makes better sense.

[evankanderson]

This is the SPDX for one of the Knative multi-arch images, but I'm not sure that it's especially helpful on its own -- this is simply a pointer to architecture-specific SBOMs for this container (and Knative probably publishes at least 60 containers per release).

With that said, I'm not sure what the goal of checking this in is, so it might still be useful to the TAG.

[evankanderson]

Oops, this was an earlier comment that hadn't been sent. Ignore!

[evankanderson]

It's also worth noting that each component has an extension model, and users will typically install one or more extensions in addition to the core components.

[JustinCappos]

A solid document. LGTM