#IstioCon Istio Architecture Connect, secure, control, and observe services. #IstioCon Security Architecture #IstioCon Bookinfo architecture without service mesh ● Reviews-v1 ○ doesn’t call accept only plain text ● UNSET: inherit from parent, default to PERMISSIVE if no set apiVersion: "security.istio.io/v1beta1“ kind: "PeerAuthentication“ metadata: name: "demo-peer-policy“ namespace: "default“ gateway Access productpage #IstioCon Authorize ingress traffic with JWT token apiVersion: "security.istio.io/v1beta1“ kind: "RequestAuthentication“ metadata: name: "jwt-example“ namespace: istio-system

speed, data integrity, and support for distributed, non-linear workflows https://try.github.io/levels/1/challenges/1 https://www.atlassian.com/university From: www.atlassian.com Mapping out Agile

past, two options for accessing multidimensional data:  Function call: data(x, y, z)  Multiple levels of array indexing: data[x][y][z]  C++23  Multidimensional subscript operator: data[x, y, z]

};f # WARNING: Don't try this! Things We Have Done 1. Hardware Isolation 2. Security Tools - SELinux, Seccomp, AppArmor, Capabilities, Cgroup 3. Intrusion Detection - Monitor suspicious nginx EOT Rust- VMM Demo Future Works • Extend Rust-VMM to support networking and storage • Security policy integration • Develop a new fully Rust-based runtime for edge computing • Support live migration

Microkernel Overview I. Background  https://en.wikipedia.org/wiki/Microkernel Security I. Background  Difference Between Microkernel and Monolithic Kernel: Source: https://www with usermode VMMs Source: https://sel4.systems/About/seL4-whitepaper.pdf 1.2.1.3 Provable Security I. Background  .  https://docs.sel4.systems/projects/l4v/ https://github

analysis Fraud & spam detection DDoS protection Application performance monitoring Logs & metrics Security events and logs. SIEM Analytics of corporate networks Telemetry Industrial monitoring Sensor data

run steady and persistent nodes for this platform? Two Major Problems ➔ End user drives, no security (or token fund) drives. ➔ Network is like a living creature, it will evolve – grow or die. The

need… • a Service Mesh, but to secure it I need… • an automated Certificate Authority, and for more security I need… • a Container scanning and monitoring service, and to monitor it more I need… • a Log Aggregation

O p s / 平 台 运 维 • I T / 基 础 设 施 • 测 试 / 安 全 团 队 持续测试 (Continuous Testing) 持续安全 (Continuous Security) 软件研发核心工程实践：交付工程 CI/CD 开发者实践 软件研发核心工程实践：全流程质量工程实践 - 持续测试 CT/ 持续安全 CS 协 同 特 点 ： • 流 程 可 定 义