2

My application consists of four microservices. (hr, salary, stock and employee). Users of the application access the "hr" service using http. To fulfill this request the hr microservice communicates with other 3 and sends back a response to the user.

I had deployed this application (4 micro-services) in a kubernetes cluster.

Then I wanted to learn Istio so I set up the same application on a mutual TLS enabled environment and set up http ingress gateway for external access. Now all my services have a sidecar which mandates mTLS communication and external user accesses this using an ingress gateway.

Can you please help me understand what sort of security advantages I introduced by moving to the Istio based deployment? What are the attack points did I just closed? Please point them as scenarios since I'm new to the security landscape.

Improve this question
6
  • 1
    You moved from clear text exchange to cyphered exchange... that's the S in https. I'm unsure of what you're after out of that – Tensibai Dec 14 '18 at 12:37
  • @Tensibai guess It means I prevented man in the middle attacks between the four microservices ? – Pasan W. Dec 14 '18 at 12:39
  • 1
    More sniffing, MITM is another kind and depending on your certificates and how each service authenticate to each other it can stil be doable – Tensibai Dec 14 '18 at 12:41
  • 2
    If your running on private VMs on private networks you haven't closed a lot of attack vectors. if your running on shared VMs and have different environments and different teams running in different k8s namespaces moving to mTLS is a big improvement assume you have good cert management (such as a cloud native KMS service). a lot of companies didn't get the full advantage of containers as they refuse to "multi-tenant" thier clusters due to security concerns. if they can certify itsio as providing good protection based on mTLS backed by a cloud vault they can run less clusters at higher density. – simbo1905 Dec 14 '18 at 14:50
  • 2
    other solutions in the security space are integrating software defined networking products into k8s that secure intra cluster traffic by policy and include intrusion detection like logging and blocking unexpected traffic. openshift Kubernetes has a couple of vendor plug-ins. Istio as a service mesh opens up being able to apply policy and potentially in the future some of the features of the commercial products (e.g. altering on unexpected connection attempts it blocks that may suggest a pod has been hijacked) – simbo1905 Dec 14 '18 at 15:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.