使用零信任覆盖网络保护API

CLINT DOVHOLUKSecure Software by Design 2024PROTECTING APIS WITH ZERO TRUST OVERLAY MESH NETWORKSABOUT METHIS IS DEFINITELY NOT ME“Developers don’t care about security“VERY COMMON THEME“SHIPPING IS A FEATURE”https://www.joelonsoftware.com/2009/09/23/the-duct-tape-programmer/ZERO TRUSTIN MY APP?ZERO TRUSTIN MY APP…LET’S SECURE SOME APIS•Long-time developer - 20+ years•Grew up with Java -> C# -> Golang -> C•Mostly API work•Telecom -> IoT -> Zero Trust Networking(THIS IS ME)What is a secure by design API?vs“Mad Max”“The Beast”StrongIdentityContinuousAuthorizationLeastPrivilegeZero TrustX.509JWTWhat is a “Strong Identity”Continual AuthorizationLeast PrivilegeWHAT IS AN “OVERLAY NETWORK”?The InternetOverlay NetworkControllerWHAT IS AN “OVERLAY NETWORK”?RouterRouterEdge RouterEdge RouterOverlay NetworkControllerWHAT IS AN “OVERLAY NETWORK”?RouterRouterEdge RouterEdge RouterServiceOverlay Network Aware ClientOverlay Network Aware ClientNO listening portsNO hole in the firewall•Self-healing•Op