Manage Network Filtering at Scale
summary
Claims management of millions of access rules across global infrastructure, implemented as a CI/CD pipeline that renders vendor configs via Capirca, with concrete scale: 30,000 access rules, ~550,000 addresses and multi‑million access elements. Built components include a risk assessment engine that scores per‑object changes and gates high‑risk edits, a graph model for relations, memory profiling to avoid device OOMs, and an auditing pipeline that runs ad‑hoc and produces internal reports; phased deploys handle remaining outages.
AI-written summary · about
chapters (17)
- 0:00Network security at Meta
- 1:26Infrastructure security layers
- 2:55Network filtering types and challenges
- 4:42Firewalls and ACLs at scale
- 6:31Manual ACL management issues
- 6:52Introducing Capria framework
- 8:19Capria policies and terms
- 9:25Capria config generation
- 9:45Capria safety services
- 10:46Policy management graph
- 11:29Risk assessment engine
- 12:57Flow guardrails and profiling
- 13:38Compliance auditing pipeline
- 14:20System wins and benefits
- 14:43Future scalability improvements
- 15:47Outage handling and deployment
- 16:50Q&A
related talks
27mCatch Me If You Can: Hunting Misconfigurations Before They...
41mAdopting Network Policies for Multi-Tenant Environments
30mRedefining Access Control: Scaling Policy as Code for Humans and AI Agents
26mBuilding Security Into Your DevOps Pipeline
36mCentralized Policy Management
25mSecurity Automation for DevOps
33mNetwork ACLs Made Easy: Establishing Zero Trust Network Policies in a Few C...
01h 05mPractical network defense at scale