mTLS Service Mesh: Controlling Lateral Movement in Microservices

What is Lateral Movement?

Lateral movement refers to an attacker's ability to move from one system or microservice to another within a network. In the context of microservices architectures, this can be particularly dangerous as each service operates independently but communicates with others for functionality. Compromising one service can provide an entry point into other services, potentially leading to full control over the entire application.

The challenge in preventing lateral movement lies in ensuring that communication between services is secure and that unauthorized access does not propagate through the network.

How mTLS Works

Mutual TLS (mTLS) is a security protocol where both the client and server verify each other’s identities using digital certificates. In an mTLS-enabled service mesh, every communication between services is encrypted and authenticated. This means that only services with valid certificates can communicate with one another, effectively preventing unauthorized access.

By leveraging mutual TLS, the service mesh ensures that all traffic is secure and that any attempt to pivot from a compromised service to other services will be detected and rejected.

Controlling Lateral Movement

In an implicit-trust mode, once one microservice is compromised, it can freely call and pivot into every other service within the network. This wide-open approach makes it easy for attackers to spread their compromise across multiple services, potentially leading to a complete breach of the system.

By enabling mTLS with allow-lists in the service mesh, you restrict communication between services based on predefined policies. Only authorized calls are allowed, and any unauthorized attempts are rejected, thereby containing the breach.

Real-World Examples

Consider a financial institution where different microservices handle various aspects of transactions, customer data management, and security. A single compromised service could potentially spread to all others, leading to widespread data breaches or unauthorized access.

Implementing mTLS with allow-lists ensures that even if one service is compromised, it cannot call other services without proper authentication, thereby containing the breach and protecting the rest of the system.

Frequently asked questions

Try it live

Everything above runs in your browser — open mTLS Service Mesh: Lateral Movement and change the parameters while it is running. Nothing is installed, nothing is uploaded, the whole model lives in one tab.