Dynamic and Context-Aware Security Policies for the Cloud Using...
summary
Prototype ties Istio + Envoy + OPA to a context server and Prometheus-derived metrics to auto-generate service-to-service mappings and enforce fine‑grained, temporal policies; an LSTM model predicts dynamic rate thresholds (LSTM-based thresholding) and OPA evaluates requests (external or sidecar) in-path. Demo shows auto-recorded destination→source maps enabling a least‑privilege Rego policy that blocks a Log4j lateral‑movement exploit. Performance tradeoffs, model drift and a pending patent are noted; not yet open sourced.
AI-written summary · about
chapters (6)
- 0:00Start
- 8:22Context-Aware Security Policies
- 8:51Architecture
- 11:33Metrics collection and curation
- 14:07Policy Enforcement
- 18:33Context Server
related talks
42mDesign Patterns for OPA and Cloud Native Authorization
38mOPA for the cloud natives
56mCloud-native Policy Enforcement
48mBeyond Entitlements for the Cloud Native
39mAddressing Cloud Security with OPA
17mSecurity and Flexibility: Decouple Policy to Enable Architectural Choice
34mFine-grained Authorization in a Containerized World
22mThe Cloud Native Paradigm: 2019 and Beyond