available #IstioCon Commits ● Small Commits - Documentation fixes, UI adjustments #IstioCon Commits ● For anything larger or bug fixes, create an issue and ask around for opinions ● General Contributing

summary 4 Audit scope 6 Overall assessment 7 Fuzzing 9 Threat model 11 Issues found 17 Review of fixes for issues from previous audit 50 Istio SLSA compliance 52 1 Istio Security Audit, 2023 Executive as future security audits. 2. Carry out a manual code audit for security issues. 3. Review the fixes for the issues found in an audit from 2020. 4. Review and improve Istio's fuzzing suite. 5. Perform disclosures follow industry standards and security advisories are clear and detailed. ● Security fixes include regression tests. A�er the manual auditing commenced, the auditing team found that the Istio

needed for the test #IstioCon Define efficient and cost-effective #IstioCon 1. Minimize time to bug detection Dev -> PR -> master -> QA -> prod 3 steps away to find a problem #IstioCon 2. Allow anything happens ● VirtualService evaluation order matters #IstioCon Checkpoint 1. Minimize time to bug detection: yes 2. Allow simultaneous tests: yes 3. Reuse infrastructure: yes #IstioCon Drawbacks

analyze ● experimental ● proxy-config ● proxy-status ● upgrade (--dry-run) ● verify-install ● bug-report #IstioCon Maintaining Istio ● Deployments ○ IstioOperator ● Monitoring ○ Prometheus

service descriptor Transform informal API to formal API External authz #IstioCon analyze describe bug-report Istio simplify troubleshooting #IstioCon You Are Innovating Too Fast! #IstioCon Istio Feature

envoy-config.yaml + Fastest - bottleneck is typing speed + No Istio dependency. Great for minimal Envoy bug reproductions + Great for rapid iteration of Envoy options - Very different from production environment

SUPPORT_URL="https://help.ubuntu.com/" 21 | Google Istio Security Assessment Google / NCC Group Confidential BUG_REPORT_URL="https://bugs.launchpad.net/ubuntu/" PRIVACY_POLICY_URL="https://www.ubuntu.com/legal/t