Cloud-native approaches to building things with computers have completely changed how modern computing works, letting us have systems that can easily grow, bounce back from problems, and adapt on the fly, all thanks to breaking applications into tiny 'microservices', packaging them in 'containers', and using systems like Kubernetes to manage it all 11, 14. But because these systems are spread about, short-lived and intensely connected to each other, the old way of protecting things with a strong outer boundary just doesn’t work 6. The National Institute of Standards and Technology’s ‘Zero Trust Architecture’ (ZTA) is a total rethink, doing away with the idea of anything being trusted by default and instead always confirming that every single part of the system is what it should be 1. This research looks at using Zero Trust ideas within cloud-native systems, with a detailed look at how to design it, how to actually put it in place, and the security compromises you have to make in these distributed setups 7, 8. We’re suggesting a complete system for building into cloud-native environments, one that brings together security focused on who you are (identity), access control guided by rules, splitting things up into very small protected sections (micro-segmentation), and constantly keeping an eye on everything 15, 16. We’ll also examine using service meshes, mutual Transport Layer Security (mTLS) and policy enforcement engines as ways of doing this, and how they might work in actual deployments 25, 27.
Maria Papadaki (Thu,) studied this question.