Muitas das solu??es t¨¦cnicas que constru¨ªmos hoje rodam em ambientes cada vez mais complexos de polycloud ou nuvem h¨ªbrida com m¨²ltiplos componentes e servi?os distribu¨ªdos. Sob essas circunst?ncias, usamos dois princ¨ªpios de seguran?a no come?o de uma implementa??o: rede com zero confian?a, ou seja, nunca confie na rede e sempre verifique; e o princ¨ªpio do m¨ªnimo privil¨¦gio, dando o m¨ªnimo de permiss?es necess¨¢rias para realizar um trabalho em particular. Os sidecars para seguran?a de terminal s?o uma t¨¦cnica comum que usamos para implementar esses princ¨ªpios para aplicar controles de seguran?a em cada terminal de componente (ex.: APIs de servi?os, armaz¨¦ns de dados ou interface de controle Kubernetes). Fazemos isso usando um sidecar fora do processo ¨C um processo ou um cont¨ºiner que ¨¦ implantado ou agendado com cada servi?o, compartilhando o mesmo contexto de execu??o, hospedagem e identidade. Open Policy Agent e s?o ferramentas que implementam essa t¨¦cnica. Sidecars para seguran?a de terminal minimizam a ¨¢rea de cobertura confi¨¢vel para um terminal local, em vez do per¨ªmetro de rede. Gostamos de ver a responsabilidade da configura??o da pol¨ªtica de seguran?a do sidecar com o time que ¨¦ respons¨¢vel pelo terminal e n?o um time centralizado separado.
Microservices architecture, with a large number of services exposing their assets and capabilities through APIs and an increased attack surface, demand a zero trust security architecture ¡ª ¡®never trust, always verify¡¯. However, enforcing security controls for communication between services is often neglected, due to increased service code complexity and lack of libraries and language support in a polyglot environment. To get around this complexity, some teams delegate security to an out-of-process sidecar ¡ª a process or a container that is deployed and scheduled with each service sharing the same execution context, host and identity. Sidecars implement security capabilities, such as transparent encryption of the communication and TLS (Transport Layer Security) termination, as well as authentication and authorization of the calling service or the end user. We recommend you look into using , or before implementing your own sidecars for endpoint security.
Microservices architecture, with a large number of services exposing their assets and capabilities through APIs and an increased attack surface, demand a zero trust security architecture ¡ª ¡®never trust, always verify¡¯. However, enforcing security controls for communication between services is often neglected, due to increased service code complexity and lack of libraries and language support in a polyglot environment. To get around this complexity, some teams delegate security to an out-of-process sidecar ¡ª a process or a container that is deployed and scheduled with each service sharing the same execution context, host and identity. Sidecars implement security capabilities, such as transparent encryption of the communication and TLS (Transport Layer Security) termination, as well as authentication and authorization of the calling service or the end user. We recommend you look into using , or before implementing your own sidecars for endpoint security.
