Microservices and the invasion of the identity entities
“Would you like to play a game?” asks the beige, boxy computer, with cheerfully glowing blue text in all-caps, vaguely like the Cheshire Cat with monochrome teeth. Matthew Broderick, once again playing the naïve adventurer, responds by dialing up global thermonuclear war, and ends up penetrating America’s missile defense network.
Along with the knife stabbing through the shower curtains in Psycho, the glowing, blue-green text of the login prompt from 1983’s WarGamesis among the most pervasive cinematic images to transcend into popular culture. (The moral of the story — never create a password that’s a family member’s name — ended up completely ignored, but the imagery did catch on.) The nebulous barrier of the netherworld in The Matrix is a rainfall of glowing green text. Most every cable news story on cyber breaches is punctuated with a backdrop of glowing green (or maybe blue, for at least some variety) illegible text. When the subject of HPE’s keynotes at its 2016 Las Vegas conference shifted from productivity to security, out went the colorful images of bustling metropolitan cities, and up came the glowing green hexadecimal digits. Even this very publication is as guilty as anyone else.
It’s an indicator of how old our prevailing, popular mental image of identity on the network still is, despite everything that’s happened in information technology since the early 80s: the GUI, the web, the iPhone, the cloud. The whole concept of “cyberspace” implies the occupancy by people, or entities that represent people, accessing resources, data files, and applications by moving from place to place like browsing a shopping mall. Identity is a virtue claimed first and foremost by people.
And that’s the problem. For any one span of time, any enterprise’s data center may be presumed to encompass every zone made available to it by the public cloud. It’s a tremendous area that would include all the inanimate objects and agents rendered capable of non-directed communication through the Internet of Things, and all the microservices that fulfill functions on behalf of organizations. To ensure against any of these things being spoofed by other things, or by people, they should arguably be identified by some means.
Read also: Between the cloud and the corporate data center, there is fog computing
You could rationally assume, as many do, that you wouldn’t need the same mechanism to identify things — or, as security engineers refer to them, entities — as you would for users who are human beings. Perhaps this will inevitably be true. But, if from an identity standpoint, entities are lesser objects than human users, it would therefore be easier for any malicious user with the smallest spot of intelligence to spoof an entity rather than a person. The weakest link in a system will be the exploited one.
We find ourselves at Waypoint #3 in our four-part series, at the center of identity in the modern network. It’s at the corner of our metaphorical map for a reason: Although we can plainly see a road in and out, what isn’t clear yet is how we get here.
“There’s going to be a lot more ‘what’s,'” described noted security expert and author Bruce Schneier, referring to a communications system whose ratio of entities to people will only grow. “What sent this? It’s going to be a streetlight sensor that’s telling me the traffic on this street is such that I’m going to try this other way. Or that I should brake now and not in fifteen milliseconds, because that’ll save my life.”
“The first thing to notice about SDP [Software-Defined Perimeter] is that it’s user-centric,” explained Jason Garbis, now Cyxtera’s vice president for products, at the RSA 2017 security conference in San Francisco last February. Garbis showed a simple diagram of human user icons linked to a network connected to a cloud, where SDP was capable of drawing a personal perimeter around each one.
