Service mesh mTLS
Service meshes (Istio, Linkerd) sidecar a proxy alongside every service pod. The proxy intercepts inbound and outbound traffic and, transparently to the application, terminates and originates mTLS using SPIFFE-style identities (e.g., spiffe://prod/ns/payments/sa/api).
Properties:
- Every service-to-service connection is mTLS without application code changes.
- Identity is per-workload (Kubernetes ServiceAccount), not per-host or per-pod.
- Certificates are short-lived (Istio default: 24h) and rotated automatically.
- Authorization policies expressed in YAML, evaluated at the proxy.
Trade-off: every hop has a sidecar, doubling memory footprint and adding latency. Linkerd's Rust data plane is lean; Istio's Envoy is fully-featured but heavier.
eBPF for network observability
eBPF lets you attach safe programs to kernel hooks: socket events, packet processing, syscalls, scheduler events. Modern security tools that use it:
- Cilium: replaces kube-proxy with eBPF-based service routing and policy enforcement. Network policies enforced at the syscall level, faster than iptables-based equivalents.
- Falco: runtime detection rules over syscall events. Catches container escapes, suspicious process spawns, file accesses.
- Tetragon: similar to Falco with kernel-level enforcement (can block, not just alert).
- Pixie: zero-instrumentation application telemetry via eBPF.
eBPF is to modern Linux observability what DTrace was to Solaris: a unified safe tracing fabric. The bug class to watch for is JIT compiler vulnerabilities in the eBPF verifier (a handful of LPE CVEs since 2020).
SD-WAN security
SD-WAN replaces hub-and-spoke MPLS with overlay tunnels over commodity internet. The security model:
- Each branch site runs an edge device that builds IPsec or WireGuard tunnels to other sites and to cloud workloads.
- A central controller manages tunnel topology, policies, and key rotation.
- Path selection by performance (latency, jitter) rather than static routes.
Security pitfalls: the controller is a high-value target; compromise enables wholesale traffic interception. Vendor controller bugs have driven advisories at Cisco, Fortinet, and Versa over the past few years. Defense: harden controller access, enable mTLS device authentication, audit topology changes.
Large-scale BGP routing security
Operators with thousands of peers (large transits, IXPs) need automation:
- IRR validation: filter accepted routes against published RouteObjects in IRRs (RADb, ARIN IRR).
- RPKI ROV: drop invalid routes. Many transits do this; MANRS encourages it.
- Max-prefix limits: cap the number of routes accepted from each peer to prevent route-leak floods.
- BGP communities: signal routing intent (do not advertise to peers, prefer/depreference, etc.) for fine-grained traffic engineering.
- RTBH / FlowSpec: rapid drop of DDoS source addresses or filtering rules pushed via BGP.
The MANRS (Mutually Agreed Norms for Routing Security) program has become the de facto standard for "this operator does the basics."
Zero-trust network in practice
The mature deployment pattern as of 2026:
- BeyondCorp-style identity-aware proxy for user access (Google, Cloudflare Access, Tailscale).
- Service mesh for service-to-service mTLS.
- Per-workload identity via SPIFFE/SPIRE or cloud-native equivalents (AWS IAM Roles for Service Accounts, GCP Workload Identity).
- Per-request authorization at the proxy (OPA, Cedar) considering user, device posture, and resource.
- Continuous risk scoring; sensitive operations re-prompt for fresh auth.
Zero-trust is plumbing more than a product. The interesting work is in making the policies practical for developers, not in buying the network gear.