Injecting Security at the Cloud Edge
summary
Claims a workable Secure Edge that injects mutual TLS to move legacy services into hybrid and multi‑cloud with minimal app rewrites, using Apache Traffic Server, Athenz and Waflz. Implements fine‑grain client‑cert selection per remap, three integration modes—delegation, tunneling, bridging—and a practical SNI vs Host header check to catch spoofing. Shows how proxies can validate athens tokens, enforce per‑name policy, and preserve strong end‑to‑end TLS while avoiding wholesale application changes.
AI-written summary · about
chapters (19)
- 0:00Intro
- 1:21Goal of Talk
- 1:59Apache Traffic Server (ATS)
- 3:46The Good Old Days, Corporate Data Centers
- 5:12Recent Past, Public Cloud
- 7:16Downsides of the Hybrid/Multi-cloud Environment
- 8:19Adding Secure Edge via TLS
- 10:02Classic Client Server TLS Authentication
- 11:01Mutual TLS Authentication
- 12:48Fine grained client certificate selection
- 13:45Retrofitting Server for TLS
- 14:28Use SNI to control TLS requirements
- 20:12Renegotiation for client certificates
- 22:21Athenz Authentication and Authorization
- 23:17TLS Delegation Athena Case
- 25:29Attacking TLS Delegation
- 27:16TLS Tunnel
- 28:40TLS Bridge
- 29:51Wrapping Up
related talks
36mEdge Security in Untrusted IoT Environments
49mSecure System Integrations
30mZero Trust Security for Legacy Apps with Service Mesh
37mDemystifying Secure Application Communication with Zero Trust and Istio Without Sidecars
10mService Mesh Security in a Nutshell
28mHow to Protect Java Microservices and React.js Micro frontends
31m"This Website is Not Secured" You Had One Job, Configuring the Edge Proxy!
28mSecuring Multi-Cloud and Hybrid Environments