Anthony Roman, Lei Tang Google April 26, 2022 Service mesh security best practices: from implementation to verification Who are we? Anthony Roman Istio Github: anthony-roman Lei Tang Istio agenda 1. Service mesh security architecture and implementation. 2. Service mesh security best practices. 3. Lifecycle of service mesh security and demo. Service mesh security architecture ● Attack Attack vectors. ● Service mesh security architecture and implementation. 1 Attack Vectors and Surfaces Istio is both a collection of security controls and an attack target. Workload Cluster Edge Operations

Connection types Multiple datasource connections Configure connection initialization settings Managing Master password Security in DBeaver PRO SSH configuration SSL configuration Proxy configuration Kubernetes Kubernetes configuration User Guide Table of contents Configure connection Network configuration settings DBeaver Lite User Guide 24.2.ea. Page 3 of 1010. AWS SSM configuration Shell commands Changing Working with AWS SSO AWS credentials System operations and security Databases authentication models Cloud databases configuration Cloud settings in DBeaver DBeaver Lite User Guide 24.2.ea. Page 4 of 1010

Connection types Multiple datasource connections Configure connection initialization settings Managing Master password Security in DBeaver PRO SSH configuration SSL configuration Proxy configuration User User Guide Table of contents Configure connection Network configuration settings DBeaver User Guide 24.2.ea. Page 3 of 1171. Kubernetes configuration AWS SSM configuration Shell commands Changing authentication Cloud Explorer overview AWS Cloud Explorer Azure Cloud Explorer System operations and security Databases authentication models Cloud databases configuration Cloud Explorer tools DBeaver User

Connection types Multiple datasource connections Configure connection initialization settings Managing Master password Security in DBeaver PRO SSH configuration SSL configuration Proxy configuration Kubernetes Kubernetes configuration User Guide Table of contents Configure connection Network configuration settings DBeaver Ultimate User Guide 24.2.ea. Page 3 of 1171. AWS SSM configuration Shell commands Changing overview AWS Cloud Explorer Azure Cloud Explorer Google Cloud Explorer System operations and security Databases authentication models Cloud databases configuration Cloud Explorer tools DBeaver Ultimate

static/ templates/ base.html __init__.py asgi.py settings.py urls.py wsgi.py manage.py requirements.in cd myproject python -m manage some settings to be modified, however. Minimally-required applications and settings To run django CMS you will only need to modify the settings.py and urls.py files. Open the new project’s settings.py file 2/ref/contrib/sites/#module-django.contrib.sites] framework. You’ll need to set a SITE_ID in the settings - SITE_ID = 1 will suffice. cms and menus are the core django CMS modules. django-treebeard [ht

Choosing Node Configuration Options 25 Storage Settings 25 Gossip Settings 25 Purging Gossip State on a Node 25 Partitioner Settings 25 Snitch Settings 26 Configuring the PropertyFileSnitch 26 Choosing Steps 32 Initializing a Cassandra Cluster on Amazon EC2 Using the DataStax AMI 32 Creating an EC2 Security Group for DataStax Community Edition 33 Launching the DataStax Community AMI 34 Connecting to phi_convict_threshold 76 Automatic Backup Properties 76 incremental_backups 76 snapshot_before_compaction 76 Security Properties 76 authenticator 76 authority 77 internode_encryption 77 keystore 77 keystore_password

Repository Cate- gories .............................................. 221 6.9. Adding New Language Settings .......... 226 6.10. Lesson Summary ............................. 227 6.11. Review Exercise ... Synaptic Package Manager Installing a Single Package File Software Repositories Adding New Language Settings Lesson Summary Review Exercise Lab Exercise Making the Most of Images and Photos 60 Introducing 1. The Ubuntu Promise • Ubuntu will always be free of charge, including enterprise releases and security updates. • Ubuntu comes with full commercial support from Canonical and hundreds of companies around

image Image Management through Pipeline Distributions Multiple teams Multiple roles Availability Security Multiple Platforms goharbor.io � VMware �� ������, ������ �������� ���:VIC�PKS GitHub Repo: Isolation • Access Control • Vulnerability • Content Trust • Replication • Control Policy SECURITY DISTRIBUTION RELIABILITY DEPLOYMENT OVERVIEW • HA Supporting • Helm Chart Repo • Deployments services Harbor Packaging Docker Kubernetes Cloud Foundry 12 Confidential � ©2018 VMware, Inc. SECURITY Isolation Access control Content Trust Vulnerability Scanning ���� NS �� ���� �� • ���������NS

image Image Management through Pipeline Distributions Multiple teams Multiple roles Availability Security Multiple Platforms goharbor.io � VMware �� ������, ������ �������� ���:VIC�PKS GitHub Repo: Isolation • Access Control • Vulnerability • Content Trust • Replication • Control Policy SECURITY DISTRIBUTION RELIABILITY DEPLOYMENT OVERVIEW • HA Supporting • Helm Chart Repo • Deployments services Harbor Packaging Docker Kubernetes Cloud Foundry 12 Confidential � ©2018 VMware, Inc. SECURITY Isolation Access control Content Trust Vulnerability Scanning ���� NS �� ���� �� • ���������NS

Tuning Istio to Meet 5G Security Requirements 12 ©2021 Aspen Mesh. All rights reserved. ● Augment tracing to surface 5G specific tags ● Optimize HTTP/2 stream and connection settings ● Configure sidecar