Create Security Team Folder and place holder files for items that need to be added. #7043

akgraner · 2023-03-15T20:18:50Z

No description provided.

kimwnasptd · 2023-03-17T15:57:22Z

Thanks for sending the PR @akgraner! Took a small look and had some nits regarding the namings and folder structure.

By being inspired at what we did for the release team https://github.com/kubeflow/community/tree/master/releases what I'd suggest would be:

security/
  meetings/
    01-02-2023.md
    01-03-2023.md
    ...
  policies-and-procedures.md
  roadmap.md
  security-team.md

The above are minor nits, but I believe will help ensure we use similar names for similar files across the project.

akgraner · 2023-03-17T15:59:24Z

@kimwnasptd thank you! I'll get those fixed. Appreciate the feedback.

redoing the entire directory and starting this again.

akgraner · 2023-03-24T15:30:55Z

delete the original directory and folders and added the directories and folders in the correct format

kimwnasptd · 2023-03-24T15:57:30Z

Thanks!

/lgtm

Added the first iteration of the Kubeflow Security Team's Policies and Procedures.

added place holders for Security Team Roadmaps.

Removed an OWNER who is not part of the org yet and added Josh and Kimonas so that we don't miss any requests.

akgraner · 2023-05-16T13:42:29Z

Thanks everyone for all the feedback. Much appreciated.
Here's what's been done.

Fixed all the empty folders
Added the first iteration of the Security Team Policies and Procedures
Added the OWNERS file
Deleted the Team Members folder and the Meetings folders
Updated the meeting link
Updated the Notes link

@kimwnasptd and @james-jwu can you please review. I think it should be good to go now.

kimwnasptd · 2023-05-16T14:07:37Z

looks great @akgraner, thank you!

/lgtm

zijianjoy · 2023-05-16T15:30:19Z

/assign @theadactyl @james-jwu

zijianjoy · 2023-05-16T16:10:44Z

security/policies-and-procedures.md

+
+The Kubeflow Security team (listed below as “we”) will take a multi-level, transparent approach to the security of Kubeflow (product/code). At this time we will base this effort to align with each release.  As noted above as we get more volunteers to help with these efforts we will continue to iterate on the cadence.  
+
+1. We will encourage Kubeflow users to open issues with the respective WG that the vulnerability was found and tag it with the “security” tag. If they don’t know how to do that or don’t feel comfortable doing so, they can also contact us via our #security slack channel.  And if a private mailing list/group is needed we will set that up. 


It is strongly recommended that we don't add a security tag to an open issue.

You can find a security template put up by CNCF in https://github.com/cncf/tag-security/tree/main/project-resources.

Reference: https://github.com/cncf/tag-security/blob/main/project-resources/templates/SECURITY.md#reporting-a-vulnerability

Most CNCF projects right now use email to notify security issue. GitHub just released their private vuln reporting feature (https://docs.github.com/en/code-security/security-advisories/guidance-on-reporting-and-writing/privately-reporting-a-security-vulnerability). Either email shared among the people who will be responsible for vuln response or this new GitHub reporting channel are fine.

@zijianjoy, I agree, but when I asked about getting an email created for the security team there was some push back. Since Google has to create the email address can you all create a security@kubeflow.org email for the team. The Working Groups asked that security issues related respective working groups be filed there so (at the time) without being able to create an official email for the group and the resources we had available we came up with the above process. I'll take a look at the resources you have listed and rework the process and bring it up to the group on the 24th at our next meeting.

In order to get this PR approved if I change this file to say we are currently working on the process and a link to our meeting notes would this work for sake of approving this?

We are in discussion about creating such email address. Make sense to track this effort in another PR. At the meantime, James Wu has LGTMed your PR here. This PR looks good to me too.

Took out the policy and procedures wording based on James Liu's comments. And will rework this based on the suggestions provided and present to the Security Team for our next meeting.

Removed jbottom from Owners list

akgraner · 2023-05-16T16:59:31Z

@james-jwu and @theadactyl - in addition to the list from earlier this morning, I also removed the wording for the policies and procedures and will rework this based on @zijianjoy's suggestions above. I removed @jbottum from owner's list. Can this PR now be approved?

james-jwu · 2023-05-16T18:07:03Z

security/policies-and-procedures.md

+
+Kubeflow Security Team [Policy and Procedure Working Document] (https://docs.google.com/document/d/1vw_efQyYG_zWEoL-vk9mZQX5p7fOcl3RTG6pcxMhYKI/edit?usp=sharing) - Please note this is only a **WORKING** Document. 
+
+We are always looking for Kubeflow community users and contributoes to help us. If you would like to help the security team with these docs or other items please consider doing the following:


Typo: contributors

@james-jwu - Thank you! Fixed this typo.

james-jwu · 2023-05-16T18:07:50Z

security/policies-and-procedures.md

+We are always looking for Kubeflow community users and contributoes to help us. If you would like to help the security team with these docs or other items please consider doing the following:
+* Join the Kubeflow Slack Security Channel: #security
+* Join our meetings bi-weekly on the Wednesday's at 8am Pacific/10am Central. (To find out what that is in your time zone go to [timeanddate.com](https://www.timeanddate.com/). This meeting is on the Kubeflow community calendar; however if you would like to be added to the invite please reach out to Amber Graner on Slack (@akgraner) The invite information is also pinned to the security slack channel. 
+* Meeting Notes: If you would like to see what we have previously discusses you can see the meetings folder in the security folder or you can go to our [gdoc](https://docs.google.com/document/d/1xGkg9GuO2OjvYhdONJFbSrpF66UKhtYonczttJoTv3s/edit?usp=sharing)


Typo: discussed

@james-jwu - Thank you! Fixed this typo.

james-jwu · 2023-05-16T18:16:50Z

/lgtm

fixed typos and hyperlink

akgraner · 2023-05-16T19:04:40Z

@james-jwu fixed the typos and the broken hyperlink which removed your lgtm. Sorry about that. Can you re-approve? Please and thank you.

james-jwu · 2023-05-16T19:58:27Z

/lgtm
/approve

google-oss-prow · 2023-05-16T19:58:34Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: eslerm, james-jwu

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~OWNERS~~ [james-jwu]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

akgraner added 10 commits March 15, 2023 09:43

Create Security

acce6a2

Delete Security

cc7f7cd

Created Security Team Folder

39dc34f

Create Policies and Procedures

03b1fad

Create 1.7 Security Team Roadmap

07c1822

Create 18 January 2023

04c2e7a

Create 1 February 2023

66c5b1e

Create 15 February 2023

488bc91

Create 1 March 2023

6f10c5c

Create 15 March 2023

bf50661

google-oss-prow bot added the size/XS label Mar 15, 2023

google-oss-prow bot requested review from pdmack and zijianjoy March 15, 2023 20:19

akgraner added 11 commits March 21, 2023 09:12

Merge branch 'kubeflow:master' into master

192b2f8

Merge branch 'kubeflow:master' into master

d9f83d7

Delete Security Team directory

232c7d8

redoing the entire directory and starting this again.

Create 01-18-2023.md

885b19f

Create 02-01-2023.md

eaf4433

Create 02-15-2023.md

98a3f58

Create 03-01-2023.md

246467a

Create 03-15-2023.md

5ce814c

Create policies-and-procedures.md

954e6ff

Create roadmap.md

22711e9

Create security-team.md

d9aa1f5

google-oss-prow bot assigned kimwnasptd Mar 24, 2023

google-oss-prow bot added the lgtm label Mar 24, 2023

google-oss-prow bot added size/M and removed size/S labels May 16, 2023

akgraner added 3 commits May 16, 2023 08:28

Update policies-and-procedures.md

47d760d

Added the first iteration of the Kubeflow Security Team's Policies and Procedures.

Update roadmap.md

0d32fa9

added place holders for Security Team Roadmaps.

Update OWNERS

3284a61

Removed an OWNER who is not part of the org yet and added Josh and Kimonas so that we don't miss any requests.

google-oss-prow bot added the lgtm label May 16, 2023

google-oss-prow bot assigned james-jwu and theadactyl May 16, 2023

zijianjoy reviewed May 16, 2023

View reviewed changes

Update policies-and-procedures.md

d070d98

Took out the policy and procedures wording based on James Liu's comments. And will rework this based on the suggestions provided and present to the Security Team for our next meeting.

google-oss-prow bot removed the lgtm label May 16, 2023

Update OWNERS

8997efa

Removed jbottom from Owners list

google-oss-prow bot removed the do-not-merge/invalid-owners-file label May 16, 2023

james-jwu reviewed May 16, 2023

View reviewed changes

google-oss-prow bot added the lgtm label May 16, 2023

james-jwu mentioned this pull request May 16, 2023

Security Tag Needed for Kubeflow Project Repositories #7136

Open

Update policies-and-procedures.md

7501a3e

fixed typos and hyperlink

google-oss-prow bot removed the lgtm label May 16, 2023

google-oss-prow bot added the lgtm label May 16, 2023

google-oss-prow bot added the approved label May 16, 2023

google-oss-prow bot merged commit f96be9a into kubeflow:master May 16, 2023
2 checks passed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Create Security Team Folder and place holder files for items that need to be added. #7043

Create Security Team Folder and place holder files for items that need to be added. #7043

akgraner commented Mar 15, 2023

kimwnasptd commented Mar 17, 2023

akgraner commented Mar 17, 2023

akgraner commented Mar 24, 2023

kimwnasptd commented Mar 24, 2023

akgraner commented May 16, 2023

kimwnasptd commented May 16, 2023

zijianjoy commented May 16, 2023

zijianjoy May 16, 2023

akgraner May 16, 2023 •

edited

zijianjoy May 16, 2023 •

edited

akgraner commented May 16, 2023 •

edited

james-jwu May 16, 2023

akgraner May 16, 2023

james-jwu May 16, 2023

akgraner May 16, 2023

james-jwu commented May 16, 2023

akgraner commented May 16, 2023

james-jwu commented May 16, 2023

google-oss-prow bot commented May 16, 2023


		The Kubeflow Security team (listed below as “we”) will take a multi-level, transparent approach to the security of Kubeflow (product/code). At this time we will base this effort to align with each release. As noted above as we get more volunteers to help with these efforts we will continue to iterate on the cadence.

		1. We will encourage Kubeflow users to open issues with the respective WG that the vulnerability was found and tag it with the “security” tag. If they don’t know how to do that or don’t feel comfortable doing so, they can also contact us via our #security slack channel. And if a private mailing list/group is needed we will set that up.


		Kubeflow Security Team [Policy and Procedure Working Document] (https://docs.google.com/document/d/1vw_efQyYG_zWEoL-vk9mZQX5p7fOcl3RTG6pcxMhYKI/edit?usp=sharing) - Please note this is only a WORKING Document.

		We are always looking for Kubeflow community users and contributoes to help us. If you would like to help the security team with these docs or other items please consider doing the following:

Create Security Team Folder and place holder files for items that need to be added. #7043

Create Security Team Folder and place holder files for items that need to be added. #7043

Conversation

akgraner commented Mar 15, 2023

kimwnasptd commented Mar 17, 2023

akgraner commented Mar 17, 2023

akgraner commented Mar 24, 2023

kimwnasptd commented Mar 24, 2023

akgraner commented May 16, 2023

kimwnasptd commented May 16, 2023

zijianjoy commented May 16, 2023

zijianjoy May 16, 2023

Choose a reason for hiding this comment

akgraner May 16, 2023 • edited

Choose a reason for hiding this comment

zijianjoy May 16, 2023 • edited

Choose a reason for hiding this comment

akgraner commented May 16, 2023 • edited

james-jwu May 16, 2023

Choose a reason for hiding this comment

akgraner May 16, 2023

Choose a reason for hiding this comment

james-jwu May 16, 2023

Choose a reason for hiding this comment

akgraner May 16, 2023

Choose a reason for hiding this comment

james-jwu commented May 16, 2023

akgraner commented May 16, 2023

james-jwu commented May 16, 2023

google-oss-prow bot commented May 16, 2023

akgraner May 16, 2023 •

edited

zijianjoy May 16, 2023 •

edited

akgraner commented May 16, 2023 •

edited