Security Slam 2023 Participation

[eddie-knight]

Hello ocm community!

In case you missed it, last week was the kickoff for the month-long Cloud Native Security Slam! You can read more about the event and find the kickoff webinar recording here.

In the kickoff last week, it was announced that there are 5 event badges that projects can pursue. There will be swag prizes and a $100 gift card awarded for the first 200 badges that are competed— that's up to $500 per project!

To help with work prioritization, we completed a survey of CNCF end users across multiple industries, including Construction, Cybersecurity, Aerospace & Defense, Game Development & Consumer Services, Consulting, and Nuclear.

Through this survey, end users have identified their interest in seeing security improvements to the projects they use. We've asked them to share which Security Slam goals are most interesting to them— and we've compiled the results in a hope that this will help your prioritization during the upcoming event.

While some users have not authorized us to share their name, we've still included their responses in our calculation for you. We CAN tell you that the ocm responses included Epic Games.

After calculating the responses according to the interest-weight, we've found these to be the most interesting things that ocm end users would like to see, from the five possible Security Slam badges.

1. The Mechanizer
2. The Defender
3. The Cleaner

You can read more about the success metrics and find resources to help you achieve them here.

Join us in the #security-slam channel on the CNCF Slack to ask questions and get help from the community!

[zhujian7]

@eddie-knight Thank you for telling us about this opportunity, I will assign this to myself
/assign

[zhujian7]

There already is a CLOMonitor dashboard: https://clomonitor.io/projects/cncf/ocm

Summary for the ocm repo:

CLOMonitor report

Summary

Repository: ocm
URL: https://github.com/open-cluster-management-io/ocm
Checks sets: CODE
Score: 74

Checks passed per category

Category	Score
Documentation	100%
License	75%
Best Practices	63%
Security	63%
Legal	n/a

Checks

Documentation [100%]

• Changelog (docs)
• Contributing (docs)
• Maintainers (docs)
• Readme (docs)

License [75%]

• Apache-2.0 (docs)
• Approved license (docs)
• License scanning (docs) : 🌱 Add fossa license scanning badge #306

Best Practices [63%]

• Artifact Hub badge (docs) : 🌱 Add artifact hub badges #300
• Contributor License Agreement (docs) EXEMPT
• Developer Certificate of Origin (docs)
• OpenSSF best practices badge (docs)
• OpenSSF Scorecard badge (docs): 🌱 Use ossf score card #302 🌱 Add open ssf scorecard badge #303
• Recent release (docs)

Security [63%]

• Binary artifacts (docs)
• Code review (docs)
• Dangerous workflow (docs)
• Dependencies policy (docs)
• Dependency update tool (docs)
• Maintained (docs)
• Software bill of materials (SBOM) (docs)
• Security insights (docs)
• Security policy (docs)
• Self-Assessment (docs)
• Signed releases (docs)
• Token permissions (docs)

For more information about the checks sets available and how each of the checks work, please see the CLOMonitor's documentation.

---

I will try to bring the score to 100%, and will also update the summary in this comment if there is any progress.

[eddie-knight]

Hey @zhujian7, did you get a chance to sign up OCM to qualify for Slam prizes?

Also, we added a getting started guide if you want to check to see whether that's helpful for you

[github-actions]

This issue is stale because it has been open for 120 days with no activity. After 14 days of inactivity, it will be closed. Remove the stable label to prevent this issue from being closed.