Patterns and techniques for securing Microservices

Описание: A DevSecCon London 2018 talk by Nick Smith:

Many new and existing systems are built using Microservices. As the number of deployed Microservices increases the complexity in security grows. The addition of multiple autonomous teams further increases the attack surface of a system as more services are pushed into production. Finally the business need to deploy 3rd-party services with “soft” security guarantees must be addressed. As a result maintaining system integrity becomes a significant challenge and one that must be managed. To mitigate some of the risks we present a background on the three A’s (Authentication, Authorization and Accounting) of computer security explaining each in detail and their importance from a broad system perspective. From there we take the audience through a set of Microservice-native patterns and tools for enforcing and managing each `A` with a focus on enforcement and measurement at the service mesh layer. At the conclusion of the talk attendees should have a greater understanding of how to apply system-level security patterns to their Microservice architecture, tools to use to implement the learnt patterns and so improving their security posture.