Applications architected as microservices are becoming more prevalent every day, but just like their monolithic ancestors, microservice applications must adhere to organization-wide constraints around compliance, zero-trust security, performance, and more. Authorization, controlling which people and machines can perform which actions, is a foundational security problem that requires new solutions in a containerized world because of changes in requirements around performance, availability, and even where authorization gets enforced architecturally.

This talk will discuss these new requirements, architectural choices for how to satisfy them, and modern technologies for rolling them out. We describe taking a policy-as-code approach where authorization policies are decoupled from the underlying microservices yet employ a shared-fate evaluation model so that policies are created and enforced consistently, meet high-availability and performance demands, and enable relatively rapid security reviews and hot-patching. Specifically, we will describe how to achieve zero trust security by design by demoing how to enforce policies through the Kuma service mesh by employing Open Policy Agent.

APIs provide the conduits connecting your customers and partners to data and services. In a zero-trust framework, you cannot trust anyone – not even authenticated users – so you must continuously monitor and assess their intent.

Attackers are prioritizing APIs as their preferred way to steal your data and disrupt your accounts and services. Research shows that more than 90% of API attacks come from authenticated users, and these attacks are getting more complex all the time. API attacks have become so prominent that OWASP created its OWASP API Security Top 10 Threats.

To protect APIs, you need deep analysis on every request and response and the ability to stitch together singular transactions into a holistic understanding of an attacker’s behavior. Attend this session to learn how to help your organization protect its vital assets, understand the patterns of top API attacks, and learn why WAFs and API gateways aren’t enough to protect you.

Shifting to an API-first development approach means a whole new way of working for developers and operators. You evangelise the benefits of change and teams put in the effort to follow your documented standards and best practises, but once the initial enthusiasm has worn off, it’s a real challenge to make this efficient and repeatable.

I’ve seen countless examples where it ends up resulting in a trade-off between achieving speed and following governance. In this session, we’ll learn from these examples and see how an APIOps approach lets you achieve both at scale by automating the enforcement of governance at the beginning of the pipeline as well as the end.

In the world of continuous delivery and cloud native, the boundaries between what is our application and what constitutes infrastructure is becoming increasing blurred. Our workloads, the containers they ship in and our platform configuration are now often developed and deployed by the same teams, and development velocity is the key metric to success. This presents us with a challenge, which the previous models of security as a final external gatekeeper step cannot keep up with. To ensure our apps and platforms are secure, we need to integrate security at all stages of our pipelines as well as ensure that our developers and engineering teams have tools and data that enable them to make decisions about security on an ongoing basis. In this session, Matt Jarvis will talk through the problem space, look at the kinds of security issues we need to consider and look at where the integration points are to build in security as part of the CI/CD process.