Merge pull request #1104 from aimichelle/pixieSelfAssess

Add Pixie Self-Assessment

assessments/projects/pixie/README.md

@@ -0,0 +1,32 @@
+# Pixie feedback
+
+## Summary
+Pixie is an observability tool that provides a quick and easy way to get information about cloud native applications without requiring manual instrumentation.
+
+Members of the STAG in the CNCF (Justin Cappos, Victor Lu, Jon Zeolla, and Ragashree Shekar) worked with the PIxie team to perform a joint assessment, which was completed in August of 2023.  During the course of the assessment, the Pixie team fixed 8 issues that were observed, showing high velocity in addressing security concerns.  
+
+## Feedback to Pixie Team
+
+- Suggest adding OCSP or CRL revocation where TLS is used (especially between Vizier and the control plane).
+    - https://github.com/pixie-io/pixie/issues/1664
+- Validate artifact signatures during auto update, and fail closed.
+    - https://github.com/pixie-io/pixie/issues/1665 
+- Update documentation to include signature validation (example here; it currently has checksum validation but not signature validation; also link to this documentation in places where using the docker image is suggested like this). 
+   - Docs have been updated with references to signature validation instructions.
+- Pixie currently does not have RBAC support for Kubernetes. Thus whomever has access to Pixie (and also the Pixie application) has admin access, which is a major concern.  In all deployments of Pixie Cloud, all users who join the org will have admin privileges.
+    - https://github.com/pixie-io/pixie/issues/1321
+- Support least-privilege in Cloud/Control-Plane proxy #1228  Services should run with only the needed level of privilege
+    - https://github.com/pixie-io/pixie/issues/1228
+- You should consider this as a way to further isolate the parts of Pixie which execute in the cloud. https://kubernetes.io/blog/2017/12/using-ebpf-in-kubernetes/- Limiting syscalls with seccomp-bpf
+- Improve detection of homoglyphs/unwanted Vizier deployments; consider a different form of encoding or display. 
+    - Filed https://github.com/pixie-io/pixie/issues/1653 and fixed with https://github.com/pixie-io/pixie/pull/1658. 
+- Document the security processes such as vulnerability disclosure, embargo notification, remediation etc. Pointers from this guidelines may help document the processes, which could then be implemented - https://contribute.cncf.io/maintainers/security/security-guidelines/
+    - Updated https://github.com/pixie-io/pixie/blob/main/SECURITY.md
+- Perform a vulnerability disclosure exercise including the initial report, remediation code change/peer review, and disclosure.
+- Clarity around the signing for the Linux binaries, script that gets the binary, docker images, etc. should be improved and likely hardened. 
+    - Added more documentation around the CLI binary in the self-assessment.
+
+## Feedback to CNCF
+
+- More documentation around how their microservices relate and are architected would help others understand the project better, 
+- Document the threat model with default configurations along with a hardening guide to understand and address risks better.