See Appendix B on page 40. 2 | Google Istio Security Assessment Google / NCC Group Confidential Dashboard Target Metadata Engagement Data Name Istio Type Architecture Review and Code-Assisted Security .go (line 30) • istio/istio/cni/cmd/istio-cni/iptables.go (line 59) • istio/istio/istioctl/cmd/dashboard.go (line 370) Impact Malicious actors may be able to execute operating system commands that could %s", out) } else { log.Infof("nsenter done: %s", out) } return err • istio/istio/istioctl/cmd/dashboard.go (line 370) func openBrowser(url string, writer io.Writer) { var err error fmt.Fprintf(writer

being promoted ○ Release notes and upgrade notes #IstioCon Continuous Release Health ● New dashboard being created to allow visibility of release health ● Open issues and priorities ● Issues being

Workload Operation GitOps Gatekeeper RBAC Audit log Metrics Security testing tools Security dashboard Prometheus Kiali Security Lifecycle Concepts Secure Monitor Enforce Verify Demo: mesh security

restart Istiod. o From envoy logs, transient 503 UH "no healthy upstream" errors. o From Grafana dashboard, Pilot Pushes shows long latencies. • Detect and analyze Istio scalability issue #IstioCon