KubeCon EU 2019 "Securing Cloud Native Communication: From End User to Service"
Download as PPTX, PDF2 likes1,619 views
The document discusses the increasing importance of securing cloud-native communications amid application modernization and hybrid platforms, emphasizing the need for decoupling apps and infrastructure securely. It highlights critical security practices such as defense in depth, network segmentation, and service mesh usage to protect data in motion. Key statistics on data breaches underline the urgency of these security measures for organizations.
KubeCon EU 2019 "Securing Cloud Native Communication: From End User to Service"
- 1. Copyright © 2019 HashiCorp Securing Cloud Native Communication: From End User to Service Daniel Bryant Product Architect, Datawire Nic Jackson Developer Advocate, HashiCorp
- 2. tl;dr ▪ We’re seeing an increase in application modernisation/hybrid platforms ▪ Decoupling apps and infrastructure is key: incrementally and securely ▪ All security must have good UX / DevEx ▪ Defence in depth is vital -- network / service security is one part of this ▪ Mind the gap(s)!
- 3. Who are we? Nic Jackson Developer Advocate, HashiCorp @sheriffjackson Daniel Bryant Product Architect, Datawire @danielbryantuk
- 4. So, we don’t want to scare you, but...
- 5. So, we don’t want to scare you, but... 214 Records containing personal data are exploited every second
- 6. So, we don’t want to scare you, but... 2.2% Of compromised records are protected by encryption
- 7. So, we don’t want to scare you, but... 65% Of cases are linked to identity theft
- 8. So, we don’t want to scare you, but... $3,860,000 Is the average cost of a data breach
- 9. So, we don’t want to scare you, but... $350,00,000 Is the cost of a breach containing over 50 million records
- 10. So, we don’t want to scare you, but... 72% Increase in attacks between 2017 and 2018 Gemalto Breach Level Index: https://breachlevelindex.com/ IBM Cost of a Data Breach Study: https://www.ibm.com/security/data-breach
- 12. We’re assuming that you have secured your data at rest… ...and hardened compute
- 13. But what about data in motion? Are your comms vulnerable?
- 14. And what about during application modernisation? Network heterogeneity typically increases: - Private DC, cloud, k8s...
- 18. API Gateway: Edge proxy, ingress, ADC... ▪ Exposes internal services to end-users (via multiple domains) ▪ Encapsulates backends (k8s, VMs, bare metal etc) ▪ TLS termination (enforcing minimum TLS version) ▪ End-user authentication/authorization ▪ Rate limiting (DDoS protection, etc)
- 20. Service Mesh: Proxy mesh, Fabric model... ▪ Exposes internal services to internal consumers ▪ Encapsulates service infra (across k8s, VMs, bare metal etc) ▪ mTLS: service identity and traffic encryption ▪ ACLs and intentions: who can do what, and to whom ▪ Implements cross-functional concerns (out-of-process)
- 21. Service Mesh: Three Pillars ▪ Observability – “Golden signals”: latency, errors, traffic, saturation (USE, RED) – Both global and service-to-service ▪ Reliability – Abstracting health checks, retries, circuit breakers etc. – Providing sane default to protect system ▪ Security – Authn/z propagation, mTLS, network segmentation
- 24. © 2019 HashiCorp 24 Bypass the perimeter by attacking services
- 25. © 2019 HashiCorp 25 We need internal network isolation
- 26. © 2019 HashiCorp 26 Network segmentation
- 27. © 2019 HashiCorp 27 Service segmentation
- 28. © 2019 HashiCorp 28 Problem: Dynamic environments...
- 29. © 2019 HashiCorp 29 Network / Service segmentation with intention-based security
- 31. https://blog.envoyproxy.io/service-mesh-data-plane-vs-control-plane-2774e720f7fc Control planes and data planes Data plane Control plane
- 32. Control planes: Differing use cases ▪ North-south – Unknown / untrusted clients – Limited exposure of services (Mapping) – Centralised ops ingress defaults + decentralised product team cfg ▪ East-west – Dynamic service information update required (multiple sources) – Identity required for all services (mTLS + ACLs) – “Sane” internal defaults + decentralised dev cfg
- 34. Copyright © 2019 HashiCorp Demo
- 35. Conclusion ▪ We’re seeing an increase in application modernisation/hybrid platforms ▪ Decoupling apps and infrastructure is key: incrementally and securely ▪ All security must have good UX / DevEx ▪ Defence in depth is vital -- network / service security is one part of this ▪ Mind the gap(s)!
- 36. References ▪ Context: – https://www.infoq.com/articles/api-gateway-service-mesh-app-modernisation/ ▪ Reference: – https://www.getambassador.io/user-guide/consul-connect-ambassador/ – https://www.getambassador.io/user-guide/consul/ – https://www.consul.io/docs/platform/k8s/ambassador.html Experiment in an Instruqt sandbox: https://instruqt.com/hashicorp/tracks/sock-shop-tutorial Code examples: https://github.com/emojify-app
- 37. Copyright © 2019 HashiCorp Questions?
- 38. Copyright © 2019 HashiCorp Thanks! @sheriffjackson | @danielbryantuk