Episode 97: Practitioner Guides: #4 Security  ## Metadata - Author: [[CHAOSScast]] - Full Title: Episode 97: Practitioner Guides: #4 Security - Category: #podcasts - URL: https://share.snipd.com/episode/b9f772e4-d0c8-43da-bc17-9e8c34188c3e ## Document Notes ## Highlights - **Security Guide Simplifies Security Start** - The Security Practitioner Guide helps maintainers without a security background start essential security practices. - It provides resources and actionable steps to keep security top of mind and learn next steps. Transcript: Harmony Elendu Yes, absolutely. Dawn Foster So historically the chaos project, we've defined a lot of metrics and we have software to gather those metrics. And we've in the past taken a very hands off approach. So we give you a pile of metrics, we give you software, and it's up to you to interpret it and decide what to do with all of that data. And what we've learned is that that doesn't work particularly well because people get overwhelmed and they just don't know where to start. So the practitioner guides are laser focused on helping people get started across a variety of topics. So these can be people who are new to open source, maybe they're new to metrics, maybe they're a new maintainer for a project. And these are designed to really just help them get started across a variety of topics. So, so far we have contributor sustainability, responsiveness, and organizational participation. Those are the other guide topics that we have, and we've done podcasts on all three of those. And so now we have a new one that's focused on security. Harmony Elendu Yeah, I'm actually excited to go through the security practitioner guides, yeah, read it, and happy we're talking about it today. I feel like we'll have like an in-depth understanding of the steps and the love of other things fully packed. But then Dawn, can you give us an overview of the security practitioner guides? Let's know what we're expecting before we get into it. Yeah, absolutely. Dawn Foster So the security practitioner guide was a particularly difficult one to develop, I think, because it's really focused on getting people started. So I think a lot of maintainers don't have a background in security, and so they don't really think about what they should be doing from a security standpoint. And so this practitioner guide really is designed to just get people started. And so there are loads of links out to resources where people can learn more, but it is very much designed to help maintainers and other people who don't have a deep security background Just do something to get security top of mind and learn where to go next with that. ([Time 0:02:08](https://share.snipd.com/snip/1291346e-5248-4fdc-a99c-2264aa86c06f)) - **Key Security Metrics** - Dependency freshness (LibYears) and release frequency are key security metrics in open source projects. - These metrics help maintainers track security in project dependencies and timely vulnerability fixes. Transcript: Harmony Elendu While security is not very important in open source software and beyond open source software. Dawn Foster Yeah, I can start with that. Some of the trends that I would look at for your own project when you're looking at security are things like we have a metric called LibYears, which is how up to date are your dependencies? Because the security of your project is only as secure as all of the other things that you pull into your project. So I think that's something that's an important trend to look at. Are you updating your dependencies more often than you used to, which would be a good change? Are you maybe not updating them as often as you should? Another trend that I would look at is release frequency. So it's great if you fix a whole bunch of security vulnerabilities, but if they never land in a release, then that becomes a problem for the people that are actually using your project. So release frequency is another one that I like to look at. And those are personally my two favorites. ([Time 0:05:50](https://share.snipd.com/snip/f7afcf35-0d68-4248-b57e-7cff6d29bd35)) - **Guide Contributors on Security** - Provide clear contributor guidelines to help new contributors avoid insecure code. - Encourage proper code reviews to catch security risks even if maintainers lack expertise. Transcript: Emily Fox So there are a variety of different groups and communities that exist in open source that are available to help answer project maintainer questions around how to start accomplishing Some of these things and trying to make sense of some of these metrics and indicators. There's more than one version control system for source code and not all best practices are going to have the same implementations depending on whether or not you're using GitHub, GitLab or something else altogether. So it's important to look towards the outcomes of what are some of these metrics trying to achieve or trying to indicate and how can you potentially start lining up your project or your Next release or other roadmap milestone items to start working towards those it could be something along the lines of making sure that you have a pr reviewer guide available for potential Contributors to understand if there is a contribution or a PR that they are submitting to your project. If it aligns with the contributions guide, have they contributed unit tests according to whatever the code is that they're contributing to make sure that you have the appropriate Level of reviews in place prior to merge. That way, when the time comes for you to cut another release, you have confidence that your contributors were able to follow the instructions that you had, reduce the probability that They're introducing poor cryptographic practices, for instance, using a defecated instance of SHA, or just verifying that they're using memory-safe coding techniques, particularly If you can provide that level of advisement to your contributors, because most of them are still new. And like you, they don't have a lot of security expertise. So you're in this unique position that while you may not be an expert, you can still provide guidance to your contributors to help improve the security of the project. ([Time 0:08:37](https://share.snipd.com/snip/a59c0adb-2682-43fc-b087-5ba781c1df5c)) - **Handle Vulnerabilities Proactively** - Establish a clear vulnerability reporting process with a security.md file. - Use existing templates and community resources to handle reports effectively. Transcript: Harmony Elendu I think we should talk about the problems that we should be expecting or that should be discovered during these processes of implementing or ensuring that these practices are actually Being used in open source projects. What are the problems that people or open source project experience when it has to do with securities? Emily Fox The most common one that any project will probably ever be exposed to is you had a vulnerability reported. And if you don't have a vulnerability reporting process in place, that can be a real struggle. You probably got a GitHub issue that revealed the vulnerability publicly to everyone, or perhaps you got an email, or if you had the opportunity to set up your security file on your project, You've provided some limited instructions. But once you have that report, most maintainers struggle with what do they do next? They know they need to respond, maybe. They know they need to fix it, maybe. But they're not entirely sure if it's an actual vulnerability with them, or maybe it's not a vulnerability at all. It could be a feature that is operating as intended, based off of how you've described your project should work. So when you have this kind of problem that you're going to encounter, having some of these processes in place is beneficial. It doesn't mean that if you don't have them, you can't respond to a problem. It means that you have a good opportunity to pause, reach out to those templates and those references and start applying those practices and methodologies. There's a wonderful series of security templates that Google had first introduced and then CNCF Tag Security added on. There's an incident response template there that I've referenced a few open source projects to as a getting started for how you respond to these kinds of things. But generally, when you are using these metrics to indicate the current security posture of your project and where you need to go. There's a lot of links and references and resources to how you can go about actually solving them and what's the most realistic path for you to do that. There's also plenty of community groups out there. OpenSSF has a ton of groups. Best Practices Working Group is an example of one that they are happy to hear from maintainers with questions. CNCF Security Tag is another one. There's a self-assessments guide in CNCF tag security that kind of talks through about how do you go through and start setting up security for your project? What are some of those initial considerations? What are your security features that you need to focus on and spend a little bit more time reviewing PRs against those? So it's a nice way of getting enough information to get started without actually giving you the answers, because the answers for your project are going to be very different than another Project. ([Time 0:11:38](https://share.snipd.com/snip/989b6b3b-141f-4d96-8aac-3a902a8c4d99)) - **Start With Simple Security Steps** - Start improving security by adding a security.md file and automating dependency update alerts. - Use OpenSSF best practices badge documentation to guide early improvements. Transcript: Dawn Foster I would say that there are a couple of things that people can start with, and we've outlined some of these in the practitioner guide in step four, which is the make improvements section. So one of them is that security.md file, which I just talked about a little bit. So the other thing in the step four, make improvements section, in addition to the security guide, is some details about going through the OpenSSF best practices badge documentation And some of the other documentation that they have, because that is a really good place to start. Another good place to start is implementing some automation in place to let you know when you have outdated dependencies so that you can keep that top of mind to keep your dependencies Up to date. I think that's another thing that you can do to get started. Emily Fox Yeah, there's a few gotchas though with getting started with some of those things. As if anything, metrics are only as good as their applicability to what they're supposed to be monitoring. And as long as there's a million different ways to code a web app up to a database, there's going to be just as many different ways of understanding why your metrics may not be reporting What you expect them to. The Overn SSF scorecard is an excellent milestone that you can start targeting towards how you can go about making some of those improvements. It pulls in indicators from best practices badging, but it is largely a little bit more automated on what your project is actually producing. But not all of the information makes a lot of sense, particularly if you're not very mature in the security of your project. So going through and actually when you're looking at some of these metrics, look at the information, look at the details for why might my project not be showing up as compliant or why Is it scoring lower than it should. It can often be that there is a misconfiguration in a file somewhere in your repo that's not conveying the right information. It could be that your latest release wasn't signed because something wasn't working at that point in time. So there's a lot of these incremental steps that you can take and you should constantly be going back in and checking those security metrics to see if the effort that you've put in is lining Up with your expectations ([Time 0:16:03](https://share.snipd.com/snip/f5f79294-3aba-4eb6-a621-c9e42e302c72)) - **Interpreting Security Metrics** - Security metrics reflect how well a project follows best practices but require context to interpret. - Incremental improvements and rechecking metrics help maintainers improve security posture effectively. Transcript: Emily Fox Yeah, there's a few gotchas though with getting started with some of those things. As if anything, metrics are only as good as their applicability to what they're supposed to be monitoring. And as long as there's a million different ways to code a web app up to a database, there's going to be just as many different ways of understanding why your metrics may not be reporting What you expect them to. The Overn SSF scorecard is an excellent milestone that you can start targeting towards how you can go about making some of those improvements. It pulls in indicators from best practices badging, but it is largely a little bit more automated on what your project is actually producing. But not all of the information makes a lot of sense, particularly if you're not very mature in the security of your project. So going through and actually when you're looking at some of these metrics, look at the information, look at the details for why might my project not be showing up as compliant or why Is it scoring lower than it should. It can often be that there is a misconfiguration in a file somewhere in your repo that's not conveying the right information. It could be that your latest release wasn't signed because something wasn't working at that point in time. So there's a lot of these incremental steps that you can take and you should constantly be going back in and checking those security metrics to see if the effort that you've put in is lining Up with your expectations for the changes that should be occurring in your project, as well as what makes the most sense for you to do. Does it make sense to go through and create an entire embargo plan associated with vulnerabilities if you don't have a simple reporting process in place to begin with? So some of these things are take small incremental steps towards improvement, come back and revisit and see how that's been feeling. Understanding where you still have some gaps in that metric reporting and understanding what else you could be doing that goes above and beyond kind of what your first steps were. ([Time 0:16:52](https://share.snipd.com/snip/819494cf-aebc-4f91-b85a-1b5f9082ce67)) - **Stepwise Security Improvement** - Identify key security trends, diagnose gaps, and make planned improvements. - Continue monitoring security metrics to ensure sustained improvement. Transcript: Harmony Elendu Thank you very, very much, Don. Thank you so much, Emily. Going through the practitioner guide, I noticed that you guys were actually able to simplify the stuff into basic steps like step one, identify and stuff like that. But for context sake and for somebody listening, would you be able to just take that again in one sentence? Emily Fox First up you need to identify what trends you should be monitoring for within your project these are things that are going to be your North Star indicators for where your project currently Is that and where it could be by identifying those such as open SSF best practices and lib years as well as your release frequency. From there, once you've identified, you can start diagnosing the gap between where you currently are and where you should be as a project. And understanding what steps you need to take to be able to get there through gathering additional information. That's going to be especially important. Then once you have all of that collective you've got your gaps you understand what additional information is required for you to start moving down that road into the security posture You're looking for for your project then you can actually start making improvements planning them as far as your traditional project release cycle and cadence for planning and make Sure that you are incorporating that within your governance as well, getting your contributors involved so you are not the only person that's doing it. Dawn Foster And then the one thing I would add is an additional step is monitoring some of this. So you measure these metrics, you make your improvements, and then you continue monitoring it to see if those improvements are continuing to stick, if you've changed actually did Make improvements according to your metrics. ([Time 0:20:13](https://share.snipd.com/snip/8352e7a4-0c82-4035-a201-142e2975041d)) - **Customize Security Guides Freely** - The open-source Practitioner Guides are MIT licensed and customizable to fit organizational needs. - Organizations can fork and adapt the guides and contribute improvements back. Transcript: Harmony Elendu You're not leaving anything out today. Dawn Foster The one additional thing I will mention is that these practitioner guides are MIT licensed and they're in a repo. So at the bottom of every practitioner guide is a link to where you can find it in the KS Data Science Working Group repository. So if you want it, if you work for an OSPO and you want to just fork it and customize it for how you do things at your company, your organization, you can fork it within your project and update It based on some things that you do. So we hope that people will contribute back some of those updates. It is open source so you can take it and you can modify it for your needs. So we've tried to do this in a really flexible manner that allows people to use these practitioner guides however they want. ([Time 0:24:24](https://share.snipd.com/snip/a1e48180-2ecc-4c08-9090-1f00db83f702)) - **Leverage Security Communities** - Use CHAOSS Slack for metric questions and OpenSSF or CNCF Security TAG for deep security queries. - Communities provide guidance and support for implementing security best practices. Transcript: Dawn Foster I would say that Chaos in particular, where we talk a lot about metrics. So I would say that if you have questions about the security metrics, I would say drop into the Chaos Slack channel, the Chaos community, and ask those questions there. I would say if you have detailed questions about security, that you might be better off going to OpenSSF to that community and getting your answers there. Because within the chaos project, we've got the metrics, we've got some getting started materials, but we don't have that deep security expertise that some of these other groups have. Emily Fox Communities like OpenSSF, definitely exactly what Don said. If you do have questions about understanding or making sense of the scorecard or the best practices badge, there is a whole community of security practitioners within OpenSSF, as Well as CNCF's Security Technical Advisory Group, that are willing to help guide you and to answer any questions that you might have, as well as potentially even kind of walk you through The process of how do you go through and create and start adopting some of these best practices and what additional things that you should be keeping mindful of on the horizon that are Coming up from a security perspective. Harmony Elendu We have provided direct links to everything that you might need just by looking at the security practitioner guides. ([Time 0:25:19](https://share.snipd.com/snip/e0424678-ebf2-42d8-a945-43e2533545cf)) - **Recharge with Hands-On Activities** - Engage in hands-on, creative activities like 3D printing to refresh your mind. - Enjoy learning new skills and stay curious despite initial challenges. Transcript: Dawn Foster Value add for this week is 3D printing. So we bought a 3D printer and my initial thinking was, that's kind of cool. I can design some chaos earrings and some open UK earrings and then I can print a bunch of stuff that other people have designed. And what I'm realizing is that I've never done any 3D design, but I'm really enjoying it. It's been a huge learning curve, but it's been loads of fun. And so my partner has been laughing at me because I am currently organizing all of the things because I can print organizers for any size and shape and thing that I want to organize. And so I have been organizing everything and just printing organizers. So it's been loads of fun. I've been really enjoying it. Now I'm trying to think about how we can fit a second one, a bigger one, because we bought the Bamboo Mini, which is small. And so now I'm thinking, how do I upgrade already, even though we've only had it for a couple of months? ([Time 0:26:53](https://share.snipd.com/snip/ffc76f03-2f4a-4c3d-a03c-ab54eaef09f9)) - **Unplug for Mental Health** - Take time to disconnect from the internet and engage in physical outdoor activities. - Giving your brain a break improves mental health and productivity. Transcript: Emily Fox My value add is make sure that you take some time to disconnect from the Internet and go outside and do something mechanical with your hands. That is taking a walk, that counts. If it's gardening, if it is putting in rain barrels at your house so that you can water your plants and your fruits and vegetables around your property, that's also great. But the intent is, is that you give your brain a break sometimes from some of those more difficult technical mental challenges and critical thinking that you're used to in your day to Day. Your brain will appreciate that mini vacation if you can give it to it. ([Time 0:28:02](https://share.snipd.com/snip/12c75b33-ee2c-44c1-a05b-83ce6234ba26)) - **Use Personal Templates** - Create personal templates for common questions and documentation to streamline work. - Templates save time and improve clarity in communications and planning. Transcript: Harmony Elendu I think someone that uses a lot of documents, making my own template makes it easier because it's for me, I know the stuff to fill in. So while making your own templates, it makes documentation easier. It makes planning the process easier. If you're into program management, you're into project planning, documentation, and lots more, just make your own templates. Makes the work faster and more interesting. It also helps you when you're sharing ideas to people to look out for, documents to help people get started, especially aspiring people, people that look up to you and your work. Dawn Foster Sorry, I'm just going to add to that. I should do more of that because I used to when I was a community manager, there's just a set of questions that you get over and over and over and over. I had little email templates that I used to answer some of those questions. So I had my own little template for how to answer kind of commonly asked questions. I have something similar for people give me governance questions because that's something I spend a lot of time on. And I've got a little snippet in one of my notes docs that is the links to all the things to help people get started. So, yeah, personal templates for the questions that you get all the time. ([Time 0:28:48](https://share.snipd.com/snip/eb471204-9964-4176-85c8-da3f2d81ccdb))