Muchas de las soluciones técnicas que creamos hoy en día se ejecutan en entornos polycloud o nube híbrida cada vez más complejos con múltiples componentes y servicios distribuidos. En tales circunstancias, aplicamos dos principios de seguridad al inicio de la implementación: red Zero trust donde se recomienda nunca confiar en la red y siempre hacer verificaciones, y el principio del privilegio mínimo, otorgando los permisos mínimos necesarios para realizar un trabajo en particular. Los Sidecars para seguridad de endpoints son una técnica común que utilizamos para implementar estos principios y así cumplir los controles de seguridad en cada endpoint del componente. Ej: APIs de servicios, almacenes de datos, control de interfaces de Kubernetes. Hacemos esto usando un sidecar fuera de proceso: un proceso o un contenedor que se implementa y programa con cada servicio que comparte el mismo contexto de ejecución, host e identidad. Open Policy Agent y Envoy, son herramientas que implementan esta técnica. Los Sidecards para seguridad de endpoints minimizan la huella confiable en un endpoint local en lugar del perímetro de la red. Nos gusta ver que la responsabilidad de la configuración de la política de seguridad del sidecar recae en el equipo responsable del endpoint y no en un equipo centralizado separado.
Microservices architecture, with a large number of services exposing their assets and capabilities through APIs and an increased attack surface, demand a zero trust security architecture — ‘never trust, always verify’. However, enforcing security controls for communication between services is often neglected, due to increased service code complexity and lack of libraries and language support in a polyglot environment. To get around this complexity, some teams delegate security to an out-of-process sidecar — a process or a container that is deployed and scheduled with each service sharing the same execution context, host and identity. Sidecars implement security capabilities, such as transparent encryption of the communication and TLS (Transport Layer Security) termination, as well as authentication and authorization of the calling service or the end user. We recommend you look into using Istio, linkerd or Envoy before implementing your own sidecars for endpoint security.
Microservices architecture, with a large number of services exposing their assets and capabilities through APIs and an increased attack surface, demand a zero trust security architecture — ‘never trust, always verify’. However, enforcing security controls for communication between services is often neglected, due to increased service code complexity and lack of libraries and language support in a polyglot environment. To get around this complexity, some teams delegate security to an out-of-process sidecar — a process or a container that is deployed and scheduled with each service sharing the same execution context, host and identity. Sidecars implement security capabilities, such as transparent encryption of the communication and TLS (Transport Layer Security) termination, as well as authentication and authorization of the calling service or the end user. We recommend you look into using Istio, linkerd or Envoy before implementing your own sidecars for endpoint security.
