So, earlier today, Google published a whitepaper on 🌟BeyondProd🌟, about how Google does cloud-native security. Here’s a summary thread /1
As much as you’ve been ask “what is cloud-native?”, I’ve been asked “how do I secure it?”. Google deploys billions of containers a week, and does so securely /2
BeyondProd is not a particular tool, but a model. It’s a realization, like in BeyondCorp, that corp security doesn’t end at the perimeter /3
Service trust should depend on code provenance and service identity, not the location in the production network, like IP address /4
The first big difference when using containers is due to scheduling. You can’t rely on IP addresses or host names for security. You need service identity /5
Since containers are meant to be redeployed when a change occurs, you need an easy way to manage rollouts - and this also gives you a choke point /6
You can actually verify and enforce what ends up in your environment, at deployment time. That’s kind of awesome /7
btw, there’s another whitepaper on this that came out today: Binary Authorization for Borg cloud.google.com/security/binar… /8
Once you know what’s running in your environment, you can restrict how services communicate and interact, based on the service identity, and more strongly isolate workloads /9
Google published a paper about two years ago on interservice communication: ALTS cloud.google.com/security/encry… /10
For developers, the best part is that these security controls are built directly into the tools they use - basically, it’s DevSecOps 💁. You can address security issues earlier, when it’s less costly, and do so in a standardized and consistent way /11
You can’t make a change to cloud-native (containers, microservices) in your infrastructure, without also changing your dev practices. (You’re missing the point, and missing out on the security benefits.) /12
TL;DR: Moving to a cloud-native infrastructure let Google meet stronger security principles. BeyondProd assumes no trust between services, isolation between workloads, verified deployments, and centralized policy management /13
Read more in the whitepaper: cloud.google.com/security/beyon… /14
If you want to do something similar yourself, there’s a list of OSS and Google technologies in this blog post to guide you: cloud.google.com/blog/products/… /15
