Implementing Security Patterns
1. Implementing Mutual TLS (mTLS)
| Property | Detail |
|---|
| Definition | Both client and server present X.509 certs |
| Use | Service-to-service authN + encryption |
| Cert rotation | SPIFFE/SPIRE, Istio Citadel, cert-manager |
| Validity | Short-lived (hours-days) preferred |
| Mesh | Istio, Linkerd, Consul Connect — auto mTLS |
2. Implementing Service-to-Service Authentication
| Mechanism | Detail |
|---|
| mTLS identity | SPIFFE ID in SAN URI |
| JWT (signed) | Per-call bearer with audience claim |
| SPIFFE/SPIRE | Workload identity framework |
| AWS IAM Roles for SA | IRSA on EKS |
| GCP Workload Identity | K8s SA → GCP SA mapping |
3. Implementing API Key Management
| Best Practice | Detail |
|---|
| Hash at rest | Store SHA-256, never plaintext |
| Prefix metadata | sk_live_... for type detection |
| Scopes | Least privilege per key |
| Rotation | Built-in rotate endpoint |
| Expiry | Optional TTL |
| Revocation | Immediate via deny list |
4. Implementing OAuth2 and OpenID Connect
| Flow | Use |
|---|
| Authorization Code + PKCE | Web / mobile / SPA (modern default) |
| Client Credentials | Service-to-service |
| Device Code | TVs, CLIs |
| Refresh Token | Long-lived re-auth |
| OIDC | OAuth2 + identity layer (id_token JWT) |
Note: Implicit flow is deprecated; use Authorization Code + PKCE for public clients.
5. Implementing Token Validation and Refresh
Example: JWT validation (Java)
JWKSet jwks = JWKSet.load(new URL(issuer + "/.well-known/jwks.json"));
JWSKeySelector<SecurityContext> sel = new JWSVerificationKeySelector<>(
JWSAlgorithm.RS256, new ImmutableJWKSet<>(jwks));
ConfigurableJWTProcessor<SecurityContext> proc = new DefaultJWTProcessor<>();
proc.setJWSKeySelector(sel);
JWTClaimsSet claims = proc.process(token, null);
if (!"my-api".equals(claims.getAudience().get(0))) throw new SecurityException();
if (claims.getExpirationTime().before(new Date())) throw new SecurityException();
| Validation | Detail |
|---|
| Signature | Verify with issuer JWKS |
| Issuer (iss) | Match expected |
| Audience (aud) | Your service id |
| Expiry (exp), nbf | Within window |
| Refresh | Use refresh_token grant; rotate refresh tokens |
6. Implementing Encryption at Rest and in Transit
| Layer | Mechanism |
|---|
| In transit | TLS 1.3, mTLS, QUIC |
| Disk (volume) | LUKS, EBS encryption, dm-crypt |
| DB | TDE (Transparent Data Encryption) |
| Field-level | App-side AES-GCM with KMS-wrapped DEK |
| Key mgmt | AWS KMS, GCP KMS, Vault, HSM |
| Envelope | DEK encrypts data, KEK encrypts DEK |
7. Implementing Secrets Management
| Tool | Detail |
|---|
| HashiCorp Vault | Dynamic secrets, leases, transit |
| AWS Secrets Manager | Auto-rotation |
| GCP Secret Manager | IAM-controlled |
| Azure Key Vault | HSM-backed |
| External Secrets Operator | Sync to K8s Secrets |
| SOPS / sealed-secrets | Encrypted in git |
8. Implementing Network Segmentation
| Layer | Tool |
|---|
| Cloud VPC | Subnets, security groups, NACLs |
| K8s | NetworkPolicy (Calico, Cilium) |
| Service mesh | AuthorizationPolicy (Istio) |
| Default deny | Allowlist only known traffic |
9. Implementing Rate Limiting for Security
| Use | Detail |
|---|
| Brute force defense | Limit auth attempts per IP/user |
| Credential stuffing | CAPTCHA + per-account lockout |
| DDoS | Cloudflare, AWS Shield, WAF rate rules |
| Per-key API quota | Tier-based limits |
10. Understanding Zero Trust Architecture
| Principle | Detail |
|---|
| Never trust, always verify | No implicit trust by network location |
| Least privilege | Per-request access decisions |
| Strong identity | mTLS / SPIFFE for workloads; SSO + MFA for users |
| Continuous verification | Re-auth, device posture |
| Microsegmentation | Per-workload policies |
11. Implementing Audit Logging
| Field | Detail |
|---|
| who | Authenticated principal |
| what | Action + resource id |
| when | UTC timestamp |
| where | Source IP, user agent |
| result | Allow / deny + reason |
| Storage | Append-only, WORM, signed |
| Retention | Per compliance (SOX 7y, HIPAA 6y) |