In Search of Segmentation
15 likes265,540 views
The document discusses the challenges of implementing effective network segmentation across modern distributed systems. It outlines several common mechanisms used for segmentation, such as VPC networks, security groups, Docker networking, and eBPF/Calico policies. However, it notes that individually these approaches face issues with scalability, coordination, and potential for misconfiguration. The document advocates for a hierarchical approach to segmentation that enforces consistent policies across layers from IAM roles to security groups to individual networks or segments. It raises open questions around coordinating policy specification and management across the different available mechanisms.
In Search of Segmentation
- 1. In Search of Segmentation Adrian Cockcroft @adrianco Technology Fellow - Battery Ventures February 2016
- 2. What does @adrianco do? @adrianco Technology Due Diligence on Deals Presentations at Conferences Presentations at Companies Technical Advice for Portfolio Companies Program Committee for Conferences Networking with Interesting PeopleTinkering with Technologies Maintain Relationship with Cloud Vendors http://www.slideshare.net/adriancockcroft
- 3. Segmentation
- 5. Airgaps closing Industrial IoT Security blanket perimeter firewalls Datacenter to cloud transitions New systems of engagement http://peanuts.wikia.com/wiki/Linus'_security_blanket
- 6. Policy
- 7. A can talk to B B can talk to C A must not talk to C A B C
- 8. Y and Z failure modes must be independent so X can always succeed Y X Z
- 9. Availability requirements drive a need for distributed segmentation
- 10. Choices?
- 12. Over-reliance on one mechanism leads to abuse…
- 13. Lack of coordination across many mechanisms leads to fragility
- 15. Disclaimer: I’m not a developer, I don’t have hands-on experience with any of these mechanisms, I’m looking for input where I’m wrong or missed something. Also, apologies if I didn’t namecheck your favorite project/product.
- 16. Datacenters/AWS Accounts IAM/AD/LDAP Roles VPC/VLAN Networks Security Groups/Hypervisor IPtables/Calico Policy Docker Links/Weave Overlay Ops Dev
- 17. B Accounts and Roles Who can set policy for what? Needs distributed policy management A C
- 18. Network Segmentation Who controls the network? A B C
- 19. Network Segmentation Datacenter policies are based on separation of duties. Tickets, Network admins and VLANs
- 20. Network Segmentation AWS VPC networking uses developer-driven automation, loses separation of duties…
- 21. VPC Abuse Antipattern Lots of small VPC networks for microservices, end up in IP address space capacity management hell…
- 22. Hypervisor and Security Group Segmentation Distributed firewall rules A B CA B
- 23. Security Group Abuse Antipattern Too many microservices need to be in the same group, overloads configuration limitations
- 24. Kernel eBPF & Calico IPtables Segmentation Distributed firewall rules A B CA B
- 25. IPtables Segmentation Can use IP Sets to scale Managed in the container host OS Separates routing reachability from access policy
- 26. Docker & Weave Segmentation Docker daemon manages connections B CA B C
- 27. proxy: build: ./proxy ports: - "8080:8080" links: - app app: build: ./app links: - db db: image: postgres Docker Compose V1 proxy app db 8080
- 28. version: '2' services: proxy: build: ./proxy ports: - "8080:8080" networks: - front app: build: ./app networks: - front - back db: image: postgres networks: - back networks: front: back: Docker Compose V2 proxy app db 8080 front backfront
- 29. Docker Segmentation Overlay network created and managed by Docker or Weave. DNS based lookups.
- 30. Segmentation Scalability Real world microservices architectures have hundreds to thousands of distinct microservices
- 31. Segmentation Scalability There’s often a few very popular microservices that everyone else wants to talk to
- 32. Datacenters/AWS Accounts IAM/AD/LDAP Roles VPC/VLAN Networks Security Groups/Hypervisor IPtables/Calico Policy Docker Links/Weave Overlay How to coordinate across all these layers? How to scale to 1000+ segments?
- 33. Hierarchical Segmentation Enforced by IAM roles at every level B CA B C E FD E F Security Group X Security Group Y VPC Z - Manage a reasonable number of large network spaces D X An AWS oriented example… AWS Account - Manage across multiple accounts
- 34. Policy Specification Options Docker Compose V2 Kubernetes/Mesos policy Calico/Cisco Contiv AWS IAM/AD Policies How to coordinate any/all of these?
- 35. Comments and Questions? Adrian Cockcroft @adrianco http://slideshare.com/adriancockcroft Technology Fellow - Battery Ventures See www.battery.com for a list of portfolio investments
- 36. Security Visit http://www.battery.com/our-companies/ for a full list of all portfolio companies in which all Battery Funds have invested. Palo Alto Networks Enterprise IT Operations & Management Big DataCompute Networking Storage