{"id":34766,"date":"2022-10-28T22:39:02","date_gmt":"2022-10-28T17:09:02","guid":{"rendered":"http:\/\/ismiletechnologies.com\/?p=34766"},"modified":"2022-12-12T18:23:18","modified_gmt":"2022-12-12T12:53:18","slug":"improving-organizational-security-by-adopting-zero-trust-in-kubernetes","status":"publish","type":"post","link":"https:\/\/ismiletechnologies.com\/en_us\/cloud-security\/improving-organizational-security-by-adopting-zero-trust-in-kubernetes\/","title":{"rendered":"Improving organizational security by adopting zero-trust in Kubernetes"},"content":{"rendered":"\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t\t\t\t\tVery recently, the White House published a memo that provides ground work for creating a zero-trust architecture for federal agencies. With new emphasis from the US government, zero-trust networking is an area that many businesses are focusing to improve their security posture. Amidst that focus, it becomes important to understand how & where these principles can be applied to cloud native environment, specifically, Kubernetes cluster.\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t\t\t\t
\n\t\t\t\n\t\t\t\t\t\t<\/span>\n\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t\t

The story so far\u00a0\u00a0<\/h2>\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

As there is a renewed emphasis to apply zero-trust principles to Kubernetes, we need to understand that it\u2019s not a new principle, and it has been there since a while. In the early 2000s, the concept of \u201cde-perimetrization of network resources\u201d was advanced in the UK. It suggested that organizations should stop relying on the perimeter controls like network firewall for securing their applications & systems. Instead, they should arrange for securing each system & directly accessing them.\u00a0\u00a0<\/p>

In the year 2014, Google published \u201cBeyondCorp: A New Approach to Enterprise Security,\u201d \u2013 it similarly looked at how enterprises can move away from network security<\/a><\/span> and ensure that users & application can ensure that callers were properly authenticated & authorized. Now we have this memo from the US government \u201cMoving the U.S. Government Towards Zero Trust Cybersecurity Principles\u201d \u2013 this again recommends that organizations should not depend on the network perimeter to protect their important data & systems.\u00a0\u00a0<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t
\n\t\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t

Do an assessment of your Azure cloud security.<\/h2>\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

Have you secured your Azure cloud environment? If you are uncertain, let our security professionals audit & secure your Azure environment.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t

\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
<\/div><\/div>\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\tProceed<\/span>\n\t\t\t\t\t<\/span>\n\t\t\t\t\t<\/a>\n\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t\t

Applying zero-trust principles to Kubernetes\u00a0\u00a0<\/h2>\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

Now that we have a goal \u2013 reducing reliance on network perimeter controls \u2013 what are the practical steps that organizations can take to introduce zero-trust concepts into Kubernetes environment?<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t\t

Service-to-service networking<\/h2>\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

At first we need to look at the container network. By default, every Kubernetes cluster provides a flat network wherein every container can communicate directly with every other container without any restrictions. This type of container network is always treated as a \u201ctrusted\u201d network by the applications running in it, and the services don\u2019t require any authentication for requests which originate from within the network. Let\u2019s say we have a range of services connected to a cluster network which can access each other at network level. How can its security be improved? We can do so by enabling Kubernetes network policies to apply default rules to both ingress & egress traffic in the cluster. Since network policies apply to workloads based on logical parameters, it can be ensured that only related workloads can communicate with each other.\u00a0<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t\t

User-to-service access\u00a0\u00a0<\/h2>\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

There\u2019s another aspect to zero-trust Kubernetes that has to be accounted for as well, this is user-to-cluster communications. Since Kubernetes does not have a provision of production-grade authentication option, external solutions will be needed to fully realize a zero-trust vision. One option would be service mesh, where user access effectively goes through some kind of proxy service before hitting the Kubernetes API, where that proxy can put controls based on things like device posture & request sensitivity.\u00a0\u00a0<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t\t\t\t
\n\t\t\t\n\t\t\t\t\t\t<\/span>\n\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

It is obvious that way for most organizations is towards adopting a zero-trust approach to organizational network security. The old days when many organizations took a hardened perimeter approach with a soft interior are numbered. However, this is going to be a long process. ISmile Technologies helps you to increase the speed of your innovation for tremendous advantage with our end-to-end solutions. Being veterans in the DevOps & Kubernetes, we leverage our years of hands-on experience to offer you out-of-the-box solutions to meet your business needs. At ISmile Technologies we see DevOps<\/a><\/span> as a no-touch CI\/CD driven software delivery approach. An approach that believes that an integrated delivery function from requirements to production will give higher business value to customers. We help you reimagine cloud security by building it into the foundation of your company, it can meet your businesses\u2019 needs as a fully managed as-a-service model ensuring seamless compliance & security.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<\/div>\n\t\t","protected":false},"excerpt":{"rendered":"

Very recently, the White House published a memo that provides ground work for creating a zero-trust architecture for federal agencies. With new emphasis from the US government, zero-trust networking is an area that many businesses are focusing to improve their security posture. Amidst that focus, it becomes important to understand how & where these principles […]<\/p>\n","protected":false},"author":3,"featured_media":34767,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[123],"tags":[],"class_list":["post-34766","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cloud-security"],"_links":{"self":[{"href":"https:\/\/ismiletechnologies.com\/en_us\/wp-json\/wp\/v2\/posts\/34766","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/ismiletechnologies.com\/en_us\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/ismiletechnologies.com\/en_us\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/ismiletechnologies.com\/en_us\/wp-json\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/ismiletechnologies.com\/en_us\/wp-json\/wp\/v2\/comments?post=34766"}],"version-history":[{"count":7,"href":"https:\/\/ismiletechnologies.com\/en_us\/wp-json\/wp\/v2\/posts\/34766\/revisions"}],"predecessor-version":[{"id":36183,"href":"https:\/\/ismiletechnologies.com\/en_us\/wp-json\/wp\/v2\/posts\/34766\/revisions\/36183"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/ismiletechnologies.com\/en_us\/wp-json\/wp\/v2\/media\/34767"}],"wp:attachment":[{"href":"https:\/\/ismiletechnologies.com\/en_us\/wp-json\/wp\/v2\/media?parent=34766"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/ismiletechnologies.com\/en_us\/wp-json\/wp\/v2\/categories?post=34766"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/ismiletechnologies.com\/en_us\/wp-json\/wp\/v2\/tags?post=34766"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}