A
B
Traditional access control for databases is provided by
network reachability and DB credentials
C
Slide 3
Slide 3 text
A
B
C
If an attacker breaks into the system and gains access to
the network, the data is compromised
Slide 4
Slide 4 text
A
B
C
A service mesh provides proper Identity primitives to
enforce runtime authentication
Envoy
Envoy
Envoy
Envoy
Slide 5
Slide 5 text
A
B
C
It also provides authorization primitives
to be enforced at runtime
PEP
PEP
PEP
PEP
Slide 6
Slide 6 text
A
B
C
Access decisions can be made based on proper
identity and high level concepts
Envoy
Envoy
Envoy
Envoy
Slide 7
Slide 7 text
EXAMPLE
Unauthorized access
Slide 8
Slide 8 text
A
B
C
NGAC provides a context-ful
authorization framework
Envoy
Envoy
Envoy
Envoy
NGAC / NDAC
P
D
P
Slide 9
Slide 9 text
A
B
C
L7 policies can be enforced, because the proxies
understand L7 protocols
Envoy
Envoy
Envoy
Envoy
NGAC / NDAC
P
D
P
Slide 10
Slide 10 text
EXAMPLE
L7 policy enforcement
Slide 11
Slide 11 text
A
B
C
L7 policies can be enforced, because the proxies
understand L7 protocols
Envoy
Envoy
Envoy
Envoy
NGAC / NDAC
P
D
P
Slide 12
Slide 12 text
A
B
C
This context-ful framework can be used to enforce
complex and dynamic policies that are environment-dependent
Envoy
Envoy
Envoy
Envoy
NGAC / NDAC
us-east1
eu-west2
P
D
P
Slide 13
Slide 13 text
EXAMPLE
Policy combination:
RBAC + Location + Time