Muchas de las soluciones t¨¦cnicas que creamos hoy en d¨ªa se ejecutan en entornos polycloud o nube h¨ªbrida cada vez m¨¢s complejos con m¨²ltiples componentes y servicios distribuidos. En tales circunstancias, aplicamos dos principios de seguridad al inicio de la implementaci¨®n: red Zero trust donde se recomienda nunca confiar en la red y siempre hacer verificaciones, y el principio del privilegio m¨ªnimo, otorgando los permisos m¨ªnimos necesarios para realizar un trabajo en particular. Los Sidecars para seguridad de endpoints son una t¨¦cnica com¨²n que utilizamos para implementar estos principios y as¨ª cumplir los controles de seguridad en cada endpoint del componente. Ej: APIs de servicios, almacenes de datos, control de interfaces de Kubernetes. Hacemos esto usando un sidecar fuera de proceso: un proceso o un contenedor que se implementa y programa con cada servicio que comparte el mismo contexto de ejecuci¨®n, host e identidad. Open Policy Agent y son herramientas que implementan esta t¨¦cnica. Los Sidecards para seguridad de endpoints minimizan la huella confiable en un endpoint local en lugar del per¨ªmetro de la red. Nos gusta ver que la responsabilidad de la configuraci¨®n de la pol¨ªtica de seguridad del sidecar recae en el equipo responsable del endpoint y no en un equipo centralizado separado.
Microservices architecture, with a large number of services exposing their assets and capabilities through APIs and an increased attack surface, demand a zero trust security architecture ¡ª ¡®never trust, always verify¡¯. However, enforcing security controls for communication between services is often neglected, due to increased service code complexity and lack of libraries and language support in a polyglot environment. To get around this complexity, some teams delegate security to an out-of-process sidecar ¡ª a process or a container that is deployed and scheduled with each service sharing the same execution context, host and identity. Sidecars implement security capabilities, such as transparent encryption of the communication and TLS (Transport Layer Security) termination, as well as authentication and authorization of the calling service or the end user. We recommend you look into using , or before implementing your own sidecars for endpoint security.
Microservices architecture, with a large number of services exposing their assets and capabilities through APIs and an increased attack surface, demand a zero trust security architecture ¡ª ¡®never trust, always verify¡¯. However, enforcing security controls for communication between services is often neglected, due to increased service code complexity and lack of libraries and language support in a polyglot environment. To get around this complexity, some teams delegate security to an out-of-process sidecar ¡ª a process or a container that is deployed and scheduled with each service sharing the same execution context, host and identity. Sidecars implement security capabilities, such as transparent encryption of the communication and TLS (Transport Layer Security) termination, as well as authentication and authorization of the calling service or the end user. We recommend you look into using , or before implementing your own sidecars for endpoint security.
