The CNCF is being looked to as a thought leader, and as I read the mission statement it seems to clearly evoke a strong leadership role “fostering and sustaining an ecosystem.”  I like Liz’s framing of the CNCF thought leadership roles as “curating, not inventing.”

To address the specific questions on security, I want to highlight some of the work of the SAFE WG, which provides a foundation for the kind of resources that I believe will be useful to executives who are making decisions about cloud native technologies and would like to understand security implications.

Published resources based on initial vision and charter:

• Use cases & Personas

• Administrator Bill of Rights

Other in-progress resources:

• Videos of use cases and security provider presentations (make more accessible index)

• Presentation template and security audit guidelines to help projects provide information on security implications of their work and provide advice to the projects themselves and the TOC

• Security overview white paper, which will likely reference more detailed work that is further along:

• Landscape

• Policy white paper

We recently prioritized the security white paper, now that it is a bit more clear the audience and purpose of that resource.  We appreciate that the CNCF and the Linux Foundation is supporting this effort and look forward to collaborating with Jessica Wilkerson, Linux Foundation Cybersecurity Research Director on that effort.  

Thank you,

Sarah Allen

SAFE WG, co-chair

p.s. I completely agree on the need for more guidance on compliance (HIPAA, GDPR have come up a lot in discussions, and my hope is that the current work on shared terminology and categorization the existing technologies and common approaches for enforcement, verification, auditing, explainability, etc. will serve as a solid foundational for additional resources.)

On Fri, Mar 22, 2019 at 12:17 PM Doug Davis <dug@...> wrote:

Yup. I kind of like what we did in the Serverless WG. We produced a whitepaper and landscape doc to help people understand what serverless is all about, what's going on in the community, what's out there for people to use (OSS vs proprietary), etc... There was a little bit of opinion mixed in, but I think it was based on experience and the general direction we were seeing the community go. Or it was more like talking about design patterns that were emerging, and when they might be appropriate. It definitely was not playing "king maker" or telling people to use one product over another.

More about education than anything else so they can make an informed decision.


thanks
-Doug
_______________________________________________________
STSM | IBM Open Source, Cloud Architecture & Technology
(919) 254-6905 | IBM 444-6905 | dug@...
The more I'm around some people, the more I like my dog

"Matt Farina" ---03/22/2019 02:10:22 PM---When I was writing the SIG Responsibilities I added a bullet under the end user education section th

From: "Matt Farina" <matt@...>
To: CNCF TOC <cncf-toc@...>
Date: 03/22/2019 02:10 PM
Subject: Re: [cncf-toc] thought leadership
Sent by: cncf-toc@...

---

When I was writing the SIG Responsibilities I added a bullet under the end user education section that reads:

White papers, presentations, videos, or other forms of training clarifying terminology, comparisons of different approaches, available projects or products, common or recommended practises, trends, illustrative successes and failures, etc.

I don’t know if I would call this “thought leadership” in the typical sense. The idea was to consolidate and clearly communicate what is going on. To share how people are solving their problems and what it does for them.

When it comes to being opinionated on how people should do things, I tend to be a bit reserved there. Different people have different needs and there is no one size fits all. And, a lot of the talk is from infrastructure folks who have different practices, goals, and cultures from the app devs running the applications. Then there is the difference between highly regulated businesses and many of the startups trying things out. There are many dimensions to differences which makes it hard to give too many recommendations on how people should do things.

--
Matt Farina
mattfarina.com