Microservices Security Landscape

1. MICROSERVICES SECURITY LANDSCAPE
Prabath Siriwardena
Senior Director - Security Architecture
prabath@wso2.com | prabath@apache.org

2. ABOUT ME
2

3. MICROSERVICES

4. SOA TO MICROSERVICES
▪ Service Oriented Architecture (SOA) is a design approach where multiple
services collaborate to provide some set of capabilities.
▪ A service is an isolated process — and the inter-service communication
happens over the network.
▪ Microservices is the SOA done right!
▪ Provides focused, scoped and modular approach for application design.
4

5. MONOLITHIC
5

6. MICROSERVICES
6

7. CHALLENGES
▪ Broader attack surface
▪ Performance
▪ Deployment complexities
▪ Observability
▪ Immutable servers
▪ Sharing user context
▪ Polyglot architecture
7

8. EDGE SECURITY

9. 9
API GATEWAY PATTERN

10. 10
API GATEWAY PATTERN

11. OAUTH 2.0
11

12. 12
SELF-CONTAINED ACCESS TOKENS

13. 13

14. SERVICE TO SERVICE SECURITY

15. TLS MUTUAL AUTHENTICATION
▪ Each microservice will have its own certificate to prove its identity
▪ How do we provision certificates to each microservice?
▪ How do we deal with certificate revocations?
▪ How do we deal with trust bootstrap?
▪ How do we deal with key rotation?
15

16. SPIFFE / SPIRE
▪ Secure Production Identity Framework for Everyone.
▪ SPIFFE tries to solve the trust bootstrap problem in a platform agnostic manner.
▪ SPIFFE provides an identity to each workload in a microservices deployment,
which is known as the SPIFFE ID.
E.g.: spiffe://acme.com/billing/payments
16

17. SPIFFE / SPIRE
17

18. JWT (JSON WEB TOKEN)
▪ Defines a container to transport data between interested parties.
▪ There are multiple applications of JWT - in OpenID Connect the id_token is
represented as a JWT.
▪ Propagate one’s identity between interested parties.
▪ Propagate user entitlements between interested parties.
▪ Transfer data securely between interested parties over a unsecured channel.
▪ Assert one’s identity, given that the recipient of the JWT trusts the asserting party.
18

19. JWT (JSON WEB TOKEN)
eyJhbGciOiJSUzI1NiIsImtpZCI6Ijc4YjRjZjIzNjU2ZGMzOTUzNjRmMWI2YzAyOTA3NjkxZjJjZGZmZTEifQ.ey
Jpc3MiOiJhY2NvdW50cy5nb29nbGUuY29tIiwic3ViIjoiMTEwNTAyMjUxMTU4OTIwMTQ3NzMyIiwiYXpwIjoiODI1
MjQ5ODM1NjU5LXRlOHFnbDcwMWtnb25ub21ucDRzcXY3ZXJodTEyMTFzLmFwcHMuZ29vZ2xldXNlcmNvbn
RlbnQuY29tIiwiZW1haWwiOiJwcmFiYXRoQHdzbzIuY29tIiwiYXRfaGFzaCI6InpmODZ2TnVsc0xCOGdGYXFSd
2R6WWciLCJlbWFpbF92ZXJpZmllZCI6dHJ1ZSwiYXVkIjoiODI1MjQ5ODM1NjU5LXRlOHFnbDcwMWtnb25ub21
ucDRzcXY3ZXJodTEyMTFzLmFwcHMuZ29vZ2xldXNlcmNvbnRlbnQuY29tIiwiaGQiOiJ3c28yLmNvbSIsImlhdCI6
MTQwMTkwODI3MSwiZXhwIjoxNDAxOTEyMTcxfQ.TVKv-pdyvk2gW8sGsCbsnkqsrS0T-
H00xnY6ETkIfgIxfotvFn5IwKm3xyBMpy0FFe0Rb5Ht8AEJV6PdWyxz8rMgX2HROWqSo_RfEfUpBb4iOsq4
W28KftW5H0IA44VmNZ6zU4YTqPSt4TPhyFC9fP2D_Hg7JQozpQRUfbWTJI
19

20. JWT (JSON WEB TOKEN)
20

21. 21
SELF ISSUED
ACCESS
TOKENS

22. 22
OAUTH 2.0
TOKEN EXCHANGE

23. ACCESS CONTROL

24. POLICY EVALUATION (CENTRAL PDP)
24

25. POLICY EVALUATION (EMBEDDED PDP)
25

26. OPEN POLICY AGENT (OPA)
▪ A lightweight general-purpose policy engine that can be co-located with your
service.
▪ Can integrate OPA as a sidecar, host-level daemon, or library.
▪ Integrated with Spring, Service Mesh implementations (Istio, Linkerd), Kafka
▪ Netflix is an early adopter of OPA
26

27. DEPLOYMENT MODELS

28. DOCKER
▪ Docker (container technology) allows to run multiple services on the same host
machine, while not only exposing a different environment to each of them, but
also isolating them from each other, similarly to VMs, but with much less
overhead.
▪ A process running in a container runs inside the host’s operating system, like all
the other processes (unlike VMs, where processes run in separate operating
systems). But the process in the container is still isolated from other processes.
28

29. KUBERNETES
▪ Kubernetes abstracts away the hardware infrastructure and exposes your whole
datacenter as a single enormous computational resource.
▪ Allows to easily deploy and manage containerized applications on top of it.
▪ Uses Linux container technologies to provide isolation of running applications.
29

30. KUBERNETES (PODs)
30

31. SIDECAR
31

32. ISTIO
32

33. SECURITY SIDECAR
33

34. SERVICE MESH
34
▪ A decentralized application networking infrastructure between the services that
provides, resiliency, security, observability, and routing control.
▪ Comprised of a control plane and a data plane.

35. THANK YOU
wso2.com