Top 10 things to consider while securing microservices

Must Read

ESDS Software to set up new data centers in 5 cities: Piyush Somani

will set up new data centers in five cities and existing three DC locations will see Phase-2 of expansion, says

Explained: 5 stumbling blocks entrepreneurs must overcome while building startup

There are many stumbling blocks that entrepreneurs may run into as they’re establishing their startup, so let’s take a deeper look at five of the most significant ones that can blight even the most experienced of business owners’ path to success

2000 teams participate in govt first hackathon to fight COVID-19

To find working solutions for mitigating the challenge of COVID-19 pandemic, MeitY started a 48- hour 'hackathon' on Friday
Nikhil Taneja
Nikhil Taneja
Nikhil Taneja is managing director - India, SAARC & Middle East at Radware

As enterprises look to become more agile and move towards a and continuous testing, the need for has grown manifolds.

Businesses require a next-generation web application firewall (WAF) that enables secure delivery of applications. Software development life cycle (SDLC), is as flexible as the dynamic environment and threat landscape and adapts to the needs of the business. Before considering any solution, make sure it meets the requirements of both development and operations () and security teams.

SQL injections, cross-site scripting, access violations, remote file inclusion — running applications in a service mesh architecture don’t eliminate the risk from data leakage or service disruptions. Emerging continuous integration and continuous delivery (CI/CD) technologies disrupt common practices and processes and create new blind spots.

Here are 10 characteristics to look for when considering protection to data and applications in a service mesh architecture.

Native Fit into CI/CD Pipeline

  • Kubernetes controlled elasticity — Easily orchestrated, grows and scales application security along with Kubernetes pods, including auto-learned policies and configuration settings.
  • Automation at the speed of development — Application programming interfaces (APIs) for integration with common tools for security provisioning of new services and applications, with a local management and reporting interface.
  • TLS termination — End-to-end encryption is necessary to secure data integrity and avoid eavesdropping and man-in-the-middle (MITM) attacks. A single TLS termination at the host also eliminates spreading multiple certificates across third parties.
  • Minimal footprint — Microservices are all about micro units; thus, the enforcement point in the data plane should be lightweight while the control plane (management, analytics and learning algorithms) is integrated into the environment independently.

Quality of Protection

  • Extensive security — Application protection today goes beyond the OWASP Top 10, so a good WAF needs to accurately detect malicious bot activity, secure APIs and mitigate denial-of-service attacks.
  • Effective security (zero-day protection) — Negative and positive security models are necessary to protect against known and unknown threats, thus maximizing security and minimizing false positives.
  • Adaptive security — Immediate detection of new and modified applications in the CI/CD pipeline isn’t enough and must be followed by automatic generation and optimization of security policies.
  • Data leakage prevention — Make sure data that is being shared externally is protected. Credit card and Social Security numbers must be masked, cookies must be encrypted, and scrapers should be misled with fake data.

Supplementary Requirements

Endorsed technology — Multiple firms evaluate technology solutions, including ICSA, NSS, Forrester and Gartner. Don’t take our word for it — check it for yourself.

Comprehensive reporting and analytics — Visibility to both development, security and operations (DevSecOps) and security teams via integration with common tools and platforms like elastic Kibana, Grafana, Prometheus, among others.

The author is Managing Director-India, SAARC & Middle East, . Views are personal.

- Advertisement -

Latest in TECH

Explained: 5 stumbling blocks entrepreneurs must overcome while building startup

There are many stumbling blocks that entrepreneurs may run into as they’re establishing their startup, so let’s take a deeper look at five of the most significant ones that can blight even the most experienced of business owners’ path to success

South Korean firm Lunit makes its AI-powered software to detect COVID-19 free

South Korea based medical AI software firm Lunit that develops AI-powered analysis of lung diseases via chest x-ray images said that it will be releasing its software online, free of charge, to help healthcare professionals manage coronavirus across the globe
- Advertisement -SAP Hana

Related Articles