The document discusses a presentation about implementing zero trust networks on Docker Enterprise Kubernetes. It begins with motivations for zero trust like changes in app architectures, security threats, and deficiencies of traditional network zoning models. It then covers using Calico and Istio on Docker Enterprise to provide zero trust security with benefits like resilience against compromise and decoupling security from network location. The presentation includes a demo of a sample app and concludes with time for questions.

1. Spike Curtis
Senior Software Engineer, Tigera
Zero Trust Networks Come to Docker
Enterprise Kubernetes
Brent Salisbury
Software Alliance Engineer, Docker

2. Agenda
• Motivation for Zero Trust Networks
− Trends in application architecture
− Trends in threat landscape
− Deficiencies of the “Zone” model
• Building Zero Trust with Docker Enterprise, Calico & Istio
− Calico & Istio architecture
− DEMO!
• Conclusion, Q&A

3. Intra-Security Zone Traffic

4. Intra-Security Zone Traffic Hairpin

5. Cost Analysis

6. Inefficient Provisioning

7. Compute Provisioning

8. Distributing Policy Across Compute

9. Growing Attack Surface

10. Growing Attack Surface

11. Zero Trust Networking
The network is
always assumed to
be hostile

12. Zero Trust Networking

13. Zero Trust Networking

14. LAN
Zero Trust Networking

15. WAN
Zero Trust Networking

16. Internet
Zero Trust Networking

17. ● Resilient against compromised devices,
workload, and network links
● Security is decoupled from network location
○ Simplified management
○ Flexible deployment
● VPNs are no longer needed
Zero Trust Networking
Advantages

18. Zero Trust Networking Software
Control Plane Data PlanePlatform

19. Calico & Istio Architecture
NodeNode
Pod
Workload
Istio
Citadel
Envoy
Felix
Pod
Workload Envoy
Felix
Mutual Authentication &
Encryption
Calico Policy
Dikastes Dikastes
IPTables IPTables

20. Demo Application
customer summary database

21. Q&A