Implementing Communication Security
1. Implementing TLS/SSL
| Setting | Recommendation |
|---|---|
| Min version | TLS 1.2; prefer 1.3 |
| Ciphers | AEAD only (no CBC, no RC4) |
| Cert source | Let's Encrypt (public), internal CA (private) |
| Renewal | cert-manager auto-renew before 30 days |
| OCSP stapling | Enable on edge proxies |
2. Using mTLS
| Aspect | Detail |
|---|---|
| Bidirectional auth | Both client and server present cert |
| Identity | Cert SAN; SPIFFE ID in mesh |
| Termination | Sidecar (Envoy) or app native |
| Pin trust | Internal root CA only |
3. Implementing Certificate Management
| Tool | Use |
|---|---|
| cert-manager | K8s native cert lifecycle |
| Vault PKI | Internal CA with short TTLs |
| ACME (Let's Encrypt) | Public certs for external endpoints |
| Rotation | Automate; alert on imminent expiry |
| Inventory | Track all issued certs |
4. Using Service-to-Service Authentication
| Mechanism | Detail |
|---|---|
| mTLS | Network-level identity |
| JWT (client_credentials) | App-level identity + scopes |
| Token exchange | Forward user identity downstream |
| SPIFFE/SPIRE | Workload identity standard |
5. Implementing API Gateway Security
| Control | Detail |
|---|---|
| TLS termination | Strong ciphers, HSTS |
| JWT validation | Verify before forwarding |
| Rate limiting | Per-IP / per-key / per-route |
| Request validation | Schema + size limits |
| WAF | OWASP CRS rules |
6. Managing Network Policies
Example: Kubernetes NetworkPolicy
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata: { name: allow-orders-from-gateway, namespace: shop }
spec:
podSelector: { matchLabels: { app: orders } }
policyTypes: [Ingress]
ingress:
- from:
- podSelector: { matchLabels: { app: gateway } }
ports:
- { protocol: TCP, port: 8080 }| Mode | Detail |
|---|---|
| Default deny | Block all then allow specific flows |
| L3/L4 | K8s NetworkPolicy |
| L7 | Mesh AuthorizationPolicy |
7. Using VPN and Private Networks
| Tool | Use |
|---|---|
| Site-to-site VPN | On-prem ↔ cloud |
| WireGuard / Tailscale | Mesh VPN, modern |
| VPC peering / Transit GW | Cross-VPC, cross-account |
| PrivateLink | Private endpoints to managed services |
| Bastion / IAP | Controlled admin access |
8. Implementing Web Application Firewall
| Capability | Detail |
|---|---|
| Rules | OWASP CRS, custom |
| Detect | SQLi, XSS, RCE, scanners |
| Mode | Detect → Block (after tuning) |
| Vendors | AWS WAF, Cloudflare, ModSecurity, Akamai |
| Tuning | Whitelist false positives; rule scoring |
9. Managing DDoS Protection
| Layer | Defense |
|---|---|
| L3/L4 (volumetric) | Cloud provider DDoS (Shield, Cloudflare) |
| L7 (app) | Rate limit, bot detection, CAPTCHA |
| Anycast | Spread traffic globally |
| Auto-scale | Absorb spikes |
| Runbook | Predefined incident response |
10. Implementing IP Whitelisting/Blacklisting
| Pattern | Detail |
|---|---|
| CIDR allow-list | Office/partner ranges only |
| Country block | GeoIP filter |
| Threat feeds | Spamhaus, AbuseIPDB |
| Caveat | IPs change; combine with auth, never sole defense |
11. Using Network Segmentation
| Layer | Tool |
|---|---|
| VPC subnets | Public/private/data tiers |
| K8s namespaces | Tenant / env separation |
| NetworkPolicy | Pod-to-pod isolation |
| Mesh AuthZ | L7 service-to-service rules |
12. Implementing Secure Service Mesh Communication
| Control | Detail |
|---|---|
| mTLS STRICT | Reject plaintext |
| AuthorizationPolicy | Default deny + allow lists |
| JWT validation | RequestAuthentication CRD |
| Egress control | ServiceEntry + egress gateway |
| Audit | Access logs from sidecars |