Secure Your Cloud with the IPsec BOSH Release - Stefan Lay, SAP
summary
Built an IPsec BOSH release that deploys site-to-site IPsec tunnels between Cloud Foundry VMs and backing services, using Linux kernel IPsec and standard tools (strongSwan/charon) configured by BOSH manifests and service index entries. It encrypts app-to-backend traffic to SAP systems, proves end-to-end transport encryption in a live demo, is Apache licensed, and introduces measurable but modest CPU and network overhead based on internal benchmarks.
AI-written summary · about
chapters (19)
- 0:00Introduction to IPsec BOSH
- 1:19Why secure cloud connections
- 2:02Basics of IPsec and TLS
- 5:05SAP Cloud Platform security scenarios
- 8:14IPsec vs TLS at network layers
- 9:27VPN tunnels and IPsec use cases
- 10:51IPsec configuration simplicity
- 12:05Open source IPsec tools
- 13:36ESP and secure traffic payload
- 15:40Establishing secure connections
- 17:04Securing Cloud Foundry traffic
- 18:42IPsec BOSH release overview
- 20:11Connecting to SAP backend
- 21:53Demo setup and tools
- 26:46Encryption process details
- 29:31Simplifying IPsec deployment
- 30:20Performance and overhead
- 31:50Network traffic inspection
- 32:14Q&A and closing
related talks
28mPsycho Security - End to End Encryption
24mPCI Compliance using Cloud Foundry and BOSH Add-ons
22mPushing the Limits: Cloud Foundry Runtime and Routing at SAP...
31mBoF: Security Best Practices in Cloud Foundry
26mThe State of Supply Chain Security in the Cloud Foundry Ecosystem
04mProject Lightning Talk: Simplifying Cloud-Native Security: eBPF-Powered Encryption in Sidecarless Service Mesh
36mCatch Me If You Can – Leveraging Cloud Foundry, SDN, BOSH and Predictive Analytics
17mDesigning a Service Mesh for Global Scale At SAP