Anthony Roman, Lei Tang Google April 26, 2022 Service mesh security best practices: from implementation to verification Who are we? Anthony Roman Istio Github: anthony-roman Lei Tang Istio agenda 1. Service mesh security architecture and implementation. 2. Service mesh security best practices. 3. Lifecycle of service mesh security and demo. Service mesh security architecture ● Attack Attack vectors. ● Service mesh security architecture and implementation. 1 Attack Vectors and Surfaces Istio is both a collection of security controls and an attack target. Workload Cluster Edge Operations

ow.com/questions/tagged/django-cms] is also a good place for questions around django CMS and its plugin ecosystem. Why django CMS? django CMS is a well-tested CMS platform that powers sites both large management interface support for a variety of editors with advanced text editing features. a flexible plugin system that lets developers put powerful tools at the fingertips of editors, without overwhelming information about what is required or has changed in particular versions of the CMS. The Commonly Used Plugin section provides an overview of other packages required in a django CMS project. Tutorials The pages

datasource connections Configure connection initialization settings Managing Master password Security in DBeaver PRO SSH configuration SSL configuration Proxy configuration Kubernetes configuration authentication Managing AWS permissions Working with AWS SSO AWS credentials System operations and security Databases authentication models Cloud databases configuration Cloud settings in DBeaver DBeaver Filter Database objects Bookmarks Projects overview Projects View Project Explorer Project security Editors overview Database Navigator panel Projects workspace Editors in DBeaver DBeaver Lite

datasource connections Configure connection initialization settings Managing Master password Security in DBeaver PRO SSH configuration SSL configuration Proxy configuration User Guide Table of authentication Cloud Explorer overview AWS Cloud Explorer Azure Cloud Explorer System operations and security Databases authentication models Cloud databases configuration Cloud Explorer tools DBeaver User Filter Database objects Bookmarks Projects overview Projects View Project Explorer Project security Editors overview Data Editor overview Data View and Format Data Filters Data viewing and editing

datasource connections Configure connection initialization settings Managing Master password Security in DBeaver PRO SSH configuration SSL configuration Proxy configuration Kubernetes configuration overview AWS Cloud Explorer Azure Cloud Explorer Google Cloud Explorer System operations and security Databases authentication models Cloud databases configuration Cloud Explorer tools DBeaver Ultimate User Guide 24.2.ea. Page 7 of 1171. Projects overview Projects View Project Explorer Project security Editors overview Data Editor overview Data View and Format Data Filters Data viewing and editing

1. The Ubuntu Promise • Ubuntu will always be free of charge, including enterprise releases and security updates. • Ubuntu comes with full commercial support from Canonical and hundreds of companies around • Separate Professional and Home editions • Less frequent and less visible re- lease schedule Security • Locked administrative user root • Rarely targeted by malware and viruses • Enables easy access Microsoft Windows are not the same. For example, Microsoft Windows Professional editions have more security features than Home editions. Ubuntu's 6 monthly release cycle also makes it very easy for users

code Scale to zero Quick entry to serverless computing … … traffic management observability security … Knative design based on knative.dev #IstioCon r How Istio is leveraged in a Knative based {revision-2}. 51ch62kjrnd.svc.cluster.local weight: 90 Knative Service Inspection #IstioCon - Security with Service Mesh enabled • mutual TLS is enabled to secure the user application traffic end to enabled • Enable Istio mesh on Knative – Impact without optimization #IstioCon o With istio CNI plugin, we can move the iptables configuration parts to CNI. But another init- container, the istio-validation

of ebpf ● Acceleration for Inbound/Outbound/Envoy to Envoy #IstioCon Istio-CNI ● The Istio CNI plugin performs the Istio mesh pod traffic redirection in the Kubernetes pod life-cycle’s network setup NET_ADMIN and NET_RAW capabilities for users deploying pods into the Istio mesh. ● The Istio CNI plugin replaces the functionality provided by the istio-init container. #IstioCon Tcp/ip stack overhead

management ○ Load balancing for VMs, failover, A/B testing, modern rollouts for VM services ● Security ○ Enforce the same policies in the same way, across compute environments ● Observability ○ See Extensibility #IstioCon Why Should Istio Support VMs ● ≈ Why VMs? ○ Technical reasons ■ Better known security controls ■ Better isolation (of resources, fault domains etc.) ■ Compatibility (non-Linux, unikernels) injection ○ automate VM registration ○ health/readiness check #IstioCon V1.7 VM Support with Added Security ● Secure bootstrapping process ○ Automate provisioning a VM's mesh identity (certificate) ■ based

Steps 32 Initializing a Cassandra Cluster on Amazon EC2 Using the DataStax AMI 32 Creating an EC2 Security Group for DataStax Community Edition 33 Launching the DataStax Community AMI 34 Connecting to phi_convict_threshold 76 Automatic Backup Properties 76 incremental_backups 76 snapshot_before_compaction 76 Security Properties 76 authenticator 76 authority 77 internode_encryption 77 keystore 77 keystore_password /usr/sbin • /etc/cassandra (configuration files) • /etc/init.d (service startup script) • /etc/security/limits.d (cassandra user limits) • /etc/default Next Steps For next steps see Configuring and