I think that an interesting aspect of cloud security to investigate is how container private networking affects security. A growing number of cloud deployed applications are designed as groups of microservices implemented with groups of containers. Within a group of containers for a microservice, the containers talk to each other over a private virtual network, and the application developer/deployer explicitly configures what services on what ports are exposed to the outside world. It would be interesting to analyze whether these private networking and segmentation improve security.

Here is a relevant link to container networking: https://docs.docker.com/engine/userguide/networking/

Hello Sir,

Great answer!

What about the Security policy ? How to decide and apply on individual segment?

Thanks.

https://www.sans.org/reading-room/whitepapers/bestprac/secure-network-design-micro-segmentation-36775

For proper security, there is a need to understudy the network layer deployed. The application developer explicitly configures what services on what ports are exposed to the outside world.

Here is a relevant link to container networking: https://docs.docker.com/engine/userguide/networking/

Pradnya,

Regarding your question on what security policy to implement on a segment, if the component containers in an isolated segment dedicated to microservice needs access to something externally, then you should turn on that access and leave everything else off (least privilege principle). Hope that helps.

Jeff Sedayao