Security Technical Advisory Group

Quick links

• Meeting Information
• Slack Information
• Working Groups

About Us

The CNCF Security Technical Advisory Group facilitates collaboration to exchange and produce knowledge and resources for building security in the cloud native ecosystem.

Cloud Native involves building, deploying, and operating modern applications in cloud computing environments, typically using open source. This complex ecosystem presents a technology risk landscape that demands rethinking application and information security through the lens of developer experience.

We aim to significantly reduce the probability and impact of attacks, breaches, and compromises. By empowering developers and operators to understand and manage the security posture of their systems, we strive to fulfill the promise of enhanced productivity and operational efficiency.

Key Focus Areas

• System Security Architectures: Frameworks to protect resources and data.
• Common Lexicon, Templates & Libraries: Tools for developers to create secure apps.
• Heuristics and Models: Approaches for reasoning about system security.

Publications

Below is a list of publications by TAG Security. For a comprehensive collection of our works in various formats, please visit the publications directory.

Publication	Latest Release
Catalog of Supply Chain Compromises	November 2019 - Present
Software Supply Chain Best Practices	March, 2025
Open and Secure - A Manual for Practicing Threat Modeling to Assess and Fortify Open Source Security	November, 2023
Handling Build-time Dependency Vulnerabilities	June, 2022
Secure Software Factory: A Reference Architecture to Securing the Software Supply Chain	May, 2022
Cloud Native Security Controls Catalog	May, 2022
Cloud Native Security Whitepaper	May, 2022
Secure Defaults	February, 2022
Cloud Native Security Lexicon	August, 2021
Evaluating your Supply Chain Security	May, 2021
Formal Verification for Policy Configurations	August, 2019

Governance

Refer to the Security TAG charter for our governance process.

Communications

Join our open discussions and share news:

• Email list
• CNCF Slack #tag-security channel (Refer to the contributing guidelines for posting and participation details.)

Meeting Information

• Americas: Weekly on Wednesdays at 10 am (UTC-7). Zoom link,
• APAC: Bi-weekly on Thursday at 11 am (UTC+9). Zoom link.

Check your local timezone here. Meetings are listed on the CNCF calendar (filter by TAG Security and Compliance!)

To add a topic to the agenda, review our process.

New members

If you are new to the group, we encourage you to check out our contributing guidelines.

Related groups

Explore groups affiliated with or relevant to Security TAG here

Leadership

Details about the TAG Chairs, Tech Leads, and TOC Liaisons can be found on the CNCF Technical Advisory Groups (TAGs) information page

TAG Emeritus Leaders

Thank you to all the tag emeritus leaders for your contributions to the success of this community.

Working Groups

The TAG's working groups focus on specific areas and organize most community activities, including weekly meetings. These groups facilitate discussions, engagement, and publications with key stakeholders, operating differently based on their needs. Each group, led by a responsible leader, reaches consensus on issues and manages logistics. All materials, such as reports, white papers, documents, and reference architectures, are in the repository's /community directory.

Project	Leads	STAG Rep
Automated Governance	Brandt Keller	Matthew Flannery
Catalog of Supply Chain Compromises	Santiago Arias Torres	Marina Moore
Commons	Eddie Knight	Marco De Benedictis
Compliance	Anca Sailer, Robert Ficcaglia	Brandt Keller
Security Assessments	Justin Cappos	Eddie Knight
Software Supply Chain	Michael Lieberman	Marina Moore

Additional information

CNCF Security TAG assessments

For CNCF project proposal process create a new security assessment issue with a self-assessment.