Enterprise Security Controls

Using open-source Project Calico, you can implement these segmentation rules. Project Calico is embedded in nearly every managed public cloud and on-premises distribution of Kubernetes and is the de-facto implementation of Kubernetes Network Policy.

While you can implement these rules using open-source Project Calico, there are a few limitations:

• Other users can inadvertently override or change your security controls. How do you detect when that happens?
• When asked for proof that security controls are and have been enforced, how do you generate a report for that? If the policies were changed or removed for a few hours last Saturday, how would you know that?

With Calico Enterprise, you can

• Implement Security Controls at a higher precedent policy tier that cannot be changed or overridden by other users
• Alert on changes to your security controls
• Generate audit reports that demonstrate compliance now and historically

Tiered Policies

Project Calico is an implementation of Kubernetes Network Policy, the network segmentation methodology native to Kubernetes. Using Calico Policies, you can segment your cluster and define which pods can talk to other pods, using declarative policy as code.

Calico Enterprise introduces the concept of Policy Tiers. Policy Tiers define the order in which network security policies are evaluated. Higher tiers evaluate traffic first. This is where you define and implement your security controls.

Policy tiers can federate across multiple clusters using Calico Enterprise Multi-Cluster Management, enabling a single definition of security controls that are applied to all clusters.

If the traffic complies with the security controls then it is evaluated by the lower tiers.

Monitoring and Alerting

Compliance Reporting

When the security team asks to see the corporate security controls you implemented, showing them YAML files is not likely going to work.

Calico Enterprise comes with a web GUI that visually describes the security controls in place in an easy to understand policy view.

The next thing the security team will ask for is which workloads are covered by the security controls and which are not. Calico Enterprise Compliance Reports show all workloads that are in-scope and not in-scope of your policy.

The security team will then need to see evidence that the security controls are operating as expected. Calico Enterprise reports on all connections evaluated by the policy and whether those connections were allowed or denied.

Finally, the security team will need to ensure that the policies haven’t been tampered with. For example, a policy didn’t change last Saturday for 2 hours, allowing the controls to be violated. Calico Enterprise tracks all changes to policies and maintains a version history of those changes.

With all this in place, you should be able to ace your next security audit.