Compliance and Zero Trust Ambient Mesh

Solving for Compliance and
Zero Trust with Istio Ambient
Mesh
Christian Posta, Global Field CTO

2 | Copyright © 2022
CHRISTIAN POSTA
VP, Global Field CTO, Solo.io
@christianposta
christian@solo.io

Solo.io - The Next Step in Your Cloud Journey
Well Funded ($135M), $1B Valuation
Satisﬁed Customers (135% Renewals)
Cloud-native Technology Leadership
Cloud-native Education Leadership
The Service Mesh and API Platform
for Kubernetes | Zero-Trust | Microservices

What does it mean to “trust”?

Trust-Full Security

Perils Lurking…

CORP is Distributed

Industry compliance (PCI, FedRAMP, PHI, PII, etc)
● Maintain a secure network
● Restrict sensitive data (card holder, patient health, identifiable info, etc)
● Track vulnerabilities, patch/upgrade known vulnerabilities
● Implement strong access control to sensitive data
● Monitor, track, and dynamically alter policy

Tenets of Zero Trust
• Assume a Hostile Environment - There are malicious persona both inside and outside the
environment
• Presume Breach - Operate and Defend resources with the assumption that an adversary
has presence in your environment
• Never Trust, Always Verify - Deny by default. Every resource is explicitly authorized using
least privilege multiple attributes, and dynamic cybersecurity principles
• Scrutinize Explicitly - Access to resources is conditional and access can dynamically
change based on action and confidence levels resulting from those actions
• Apply Unified Analytics - for data, applications, assets, services to include behavioristics
and log each transaction

Zero Trust Security

Zero Trust Architecture Frameworks
NIST, CISA Zero Trust Framework MIT ZTA Framework: Principles -> “Job to be done”
Identity
Verification Access
Control Resource
Protection
Policy and Orchestration
Monitoring and Analytics
Continuous Cybersecurity
Operations

Zero Trust Architecture Frameworks
NIST SP
800-204A/B
NIST SP 800-53
NIST SP
800-207
Service Mesh Configuration
Network Policy 𑇐 Transparent TLS encryption
L
4
L
7
Strong Identity
Authentication, Authorization and Audit (AAA)
API Gateway 𑇐 OpenAPI Spec
Future Controls
GitOps
Friendly
Traffic Policy 𑇐 A/B 𑇐 Canary 𑇐 OWASP

Boiling it Down…
● All communication to resources is secured, regardless of location on the
network
● Access to resources is granted per session
● Access to resources is determined dynamically
● All-access is authenticated and authorized
● Access is tracked, logged, audited, and can be dynamically revoked

Zero Trust (abstract)

Service Mesh Can Help

What is Service Mesh?

Application Networking

Istio - Open Source Service Mesh
2017
Istio Launched
Data Plane
Enhancements
2019-20
7 New Community Releases
1000s Production Users
~ 1000 Community Contributors
2022
CNCF
2019-2022

Can this be improved?

Istio Data Plane
https://www.solo.io/blog/ebpf-for-service-mesh/

Istio Data Plane

Introducing Istio Ambient Mesh
A new, open source contribution to the Istio project,
that defines a new sidecar-less data plane.
Improve
Performance
Simplify
Operations
Cost
Reduction
https://istio.io/latest/blog/2022/introducing-ambient-mesh/

How does it work?
● Separate mesh capabilities into L4
and L7
● Adopt only the capabilities you need
● Remove the data plane from the
workload Pods
● Leverage more capabilities in the
CNI
● Reduce attack surface of data plane

How does it work?

Benefits
● No more race conditions between workload
containers and sidecar/init-container, etc
● Don’t need to inject Pods / alter
deployment resources
● Upgrades/patching are out of band /
transparent from the application
● Limited risk profile for opting into mesh
features
● Reduced blast radius of application
vulnerabilities
● Cost savings with reduced data plane
components
● Maintain isolated tenancy, customization,
configuration
● Maintain the foundations of zero-trust
network security
● Improved performance

Additional Resources
● https://lp.solo.io/white-paper-zero-trust
● https://www.solo.io/blog/apis-data-breach-zero-trust/
● https://www.solo.io/topics/zero-trust/
● https://www.solo.io/zero-trust/
● https://academy.solo.io
● https://istio.io
https://lp.solo.io/istio-ambient-mesh-explained

Compliance and Zero Trust Ambient Mesh

More Related Content

What's hot

Similar to Compliance and Zero Trust Ambient Mesh

More from Christian Posta

Recently uploaded

Compliance and Zero Trust Ambient Mesh