Identity-aware Microsegmentation

Supporting documentation for the Calico Cloud Quickstart Self Guided Workshop. The objective of this workshop is to help participants understand security policy frameworks and methodologies to implement identity-based microsegmentation in Kubernetes.

Introduction

Table of Contents

01. Module 1 - Lab Setup

• Module 1 - Introduction
• Lesson 1 - Connect Cluster to Calico Cloud
• Lesson 2 - Deploy Applications
• Lesson 3 - Deploy Ingress Controller
• Lesson 4 - Create Ingress Resources for Applications

02. Module 2 - Calico Security Policy Constructs

• Module 2 - Introduction
• Lesson 1 - The Anatomy of a Security Policy

03. Module 3 - Security Policy Framework for Identity-Based Micro-segmentation

• Module 3 - Introduction
• Lesson 1 - Security Policy Framework Overview
• Lesson 2 - The Security Tier
• Lesson 3 - The Platform Tier
• Lesson 4 - The Application Tier
• Lesson 5 - The Appsec Tier
• Lesson 6 - The Default Tier

04. Module 4 - Methodology for Implementing Zero-Trust Microsegmentation

• Module 4 - Introduction

1. Step 1 - Identify

• Lesson 1 - Service Graph - Views and Layers

2. Step 2 - Analyze

• Lesson 2 - Flow Log Aggregtion
• Lesson 3 - Service Graph and Flow Visualization - Analyzing Application Flows
• Lesson 4 - Anaylze Flows to kube-dns
• Lesson 5 - Analyze Traffic to External Services using Service Graph and Kibana
• Lesson 6 - Create Domain Networksets for External Services

3. Step 3 - Deploy Security Policies for Applications

• Lesson 7 - Deploy Tiers
• Lesson 8 - Security Policies in the Default Tier
• Lesson 9 - Security Policies in the Security Tier
• Lesson 10 - Security Policies in the Platform Tier
• Lesson 11 - Security Policies in the Application Tier
• Lesson 12 - Security Policies in the Appsec Tier
• Lesson 13 - Validate Security Policies

4. Step 4 - Enforce Default Deny for Applications

• Lesson - 14 - Enforce Default Deny for Application Namespaces

5. Step 5 - Assess and Remediate

• Lesson 15 - Introduce New Flows
• Lesson 16 - Using Service Graph to Identify Denied Flows
• Lesson 17 - Using Flow Vizualization to Identify Denied Flows
• Lesson 18 - Using Kibana to Identify Denied Flows
• Lesson 19 - Remediate Security Policies to Permit Denied Flows
• Lesson 20 - Validate Remediated Security Policies

05. Module 5 - Expanding the Security Policy Framework

[Coming Soon]

---

Quick Access - Lesson Videos

• 1.1 - Connect Cluster to Calico Cloud
• 1.2 - Deploy Applications
• 4.1 - Service Graph - Views and Layers
• 4.2 - Flow Log Aggregation
• 4.3 - Service Graph and Flow Visualization - Analyzing Application Flows
• 4.7 - Deploying Security Policy Tiers
• 4.12 - Service Graph - Security Policy Processing Sequence
• 4.14 - Enforce Default Deny for Application Namespaces
• 4.16 - Using Service Graph to Identify Denied Flows
• 4.17 - Using Flow Vizualization to Identify Denied Flows

Security Policy Templates

• Policy Tiers

---

Upcoming Lessons

• source and destination reporting
• kibana filtering based on index
• Using services in security policy rules
• Security policy evaluation in logs --