Downloaded 37 times
Uploaded byPrabath Siriwardena
Microservices Security Landscape
This document discusses security considerations for microservices architectures. It covers edge security using API gateways, service-to-service authentication using TLS and JWT, access control using centralized and embedded policy decision points, deployment models like Docker and Kubernetes, and the use of sidecars and service meshes like Istio for security. Key challenges with microservices include a broader attack surface, performance issues, and complexity in deployment and observability across services.
More Related Content
Similar to Microservices Security Landscape
![[WSO2Con Asia 2018] Talk Microservices to Me: The Role of IAM in Microservice...](https://cdn.slidesharecdn.com/ss_thumbnails/wso2conasia18talktheroleofiaminmicroservicesarchitecture-180810100941-thumbnail.jpg?width=640&height=640&fit=bounds)
Microservices Security Landscape
- 1. MICROSERVICES SECURITY LANDSCAPE PrabathSiriwardena Senior Director - Security Architecture prabath@wso2.com | prabath@apache.org
- 2.
- 3.
- 4. SOA TO MICROSERVICES ▪Service Oriented Architecture (SOA) is a design approach where multiple services collaborate to provide some set of capabilities. ▪ A service is an isolated process — and the inter-service communication happens over the network. ▪ Microservices is the SOA done right! ▪ Provides focused, scoped and modular approach for application design. 4
- 5.
- 6.
- 7. CHALLENGES ▪ Broader attacksurface ▪ Performance ▪ Deployment complexities ▪ Observability ▪ Immutable servers ▪ Sharing user context ▪ Polyglot architecture 7
- 8.
- 9.
- 10.
- 11.
- 12.
- 13.
- 14. SERVICE TO SERVICESECURITY
- 15. TLS MUTUAL AUTHENTICATION ▪Each microservice will have its own certificate to prove its identity ▪ How do we provision certificates to each microservice? ▪ How do we deal with certificate revocations? ▪ How do we deal with trust bootstrap? ▪ How do we deal with key rotation? 15
- 16. SPIFFE / SPIRE ▪Secure Production Identity Framework for Everyone. ▪ SPIFFE tries to solve the trust bootstrap problem in a platform agnostic manner. ▪ SPIFFE provides an identity to each workload in a microservices deployment, which is known as the SPIFFE ID. E.g.: spiffe://acme.com/billing/payments 16
- 17.
- 18. JWT (JSON WEBTOKEN) ▪ Defines a container to transport data between interested parties. ▪ There are multiple applications of JWT - in OpenID Connect the id_token is represented as a JWT. ▪ Propagate one’s identity between interested parties. ▪ Propagate user entitlements between interested parties. ▪ Transfer data securely between interested parties over a unsecured channel. ▪ Assert one’s identity, given that the recipient of the JWT trusts the asserting party. 18
- 19. JWT (JSON WEBTOKEN) eyJhbGciOiJSUzI1NiIsImtpZCI6Ijc4YjRjZjIzNjU2ZGMzOTUzNjRmMWI2YzAyOTA3NjkxZjJjZGZmZTEifQ.ey Jpc3MiOiJhY2NvdW50cy5nb29nbGUuY29tIiwic3ViIjoiMTEwNTAyMjUxMTU4OTIwMTQ3NzMyIiwiYXpwIjoiODI1 MjQ5ODM1NjU5LXRlOHFnbDcwMWtnb25ub21ucDRzcXY3ZXJodTEyMTFzLmFwcHMuZ29vZ2xldXNlcmNvbn RlbnQuY29tIiwiZW1haWwiOiJwcmFiYXRoQHdzbzIuY29tIiwiYXRfaGFzaCI6InpmODZ2TnVsc0xCOGdGYXFSd 2R6WWciLCJlbWFpbF92ZXJpZmllZCI6dHJ1ZSwiYXVkIjoiODI1MjQ5ODM1NjU5LXRlOHFnbDcwMWtnb25ub21 ucDRzcXY3ZXJodTEyMTFzLmFwcHMuZ29vZ2xldXNlcmNvbnRlbnQuY29tIiwiaGQiOiJ3c28yLmNvbSIsImlhdCI6 MTQwMTkwODI3MSwiZXhwIjoxNDAxOTEyMTcxfQ.TVKv-pdyvk2gW8sGsCbsnkqsrS0T- H00xnY6ETkIfgIxfotvFn5IwKm3xyBMpy0FFe0Rb5Ht8AEJV6PdWyxz8rMgX2HROWqSo_RfEfUpBb4iOsq4 W28KftW5H0IA44VmNZ6zU4YTqPSt4TPhyFC9fP2D_Hg7JQozpQRUfbWTJI 19
- 20. JWT (JSON WEBTOKEN) 20
- 21.
- 22.
- 23.
- 24. POLICY EVALUATION (CENTRALPDP) 24
- 25. POLICY EVALUATION (EMBEDDEDPDP) 25
- 26. OPEN POLICY AGENT(OPA) ▪ A lightweight general-purpose policy engine that can be co-located with your service. ▪ Can integrate OPA as a sidecar, host-level daemon, or library. ▪ Integrated with Spring, Service Mesh implementations (Istio, Linkerd), Kafka ▪ Netflix is an early adopter of OPA 26
- 27.
- 28. DOCKER ▪ Docker (containertechnology) allows to run multiple services on the same host machine, while not only exposing a different environment to each of them, but also isolating them from each other, similarly to VMs, but with much less overhead. ▪ A process running in a container runs inside the host’s operating system, like all the other processes (unlike VMs, where processes run in separate operating systems). But the process in the container is still isolated from other processes. 28
- 29. KUBERNETES ▪ Kubernetes abstractsaway the hardware infrastructure and exposes your whole datacenter as a single enormous computational resource. ▪ Allows to easily deploy and manage containerized applications on top of it. ▪ Uses Linux container technologies to provide isolation of running applications. 29
- 30.
- 31.
- 32.
- 33.
- 34. SERVICE MESH 34 ▪ Adecentralized application networking infrastructure between the services that provides, resiliency, security, observability, and routing control. ▪ Comprised of a control plane and a data plane.
- 35.