Zero Trust and API Security: Implementing Robust Authentication with Edge Stack

Zero Trust generated huge momentum in 2023. Okta’s The State of Zero Trust Security 2023 states that 61% of organizations are already implementing Zero Trust, with another 35% planning to soon. 2023, Gartner’s Strategic Roadmap for Zero Trust Security Program Implementation report was published, detailing how to define your roadmap to Zero Trust.

It might come as a surprise to learn that Zero Trust was first described 30 years ago this April in 1994. Why has it taken so long to gain traction? It comes down to the technology not being in place. But in 2024, with Kubernetes and solutions such as Edge Stack API Gateway, service meshes, mTLS, and other advanced security technologies, organizations now have the tools they need to effectively implement Zero Trust architectures and secure their APIs dynamically and scalable.

A vital component of that is robust authentication. If you can’t determine who your users are, you can’t then use that information throughout your infrastructure to control access. Let’s see how you can implement authentication with Edge Stack API Gateway as the start of a Zero Trust framework.

The Cadbury Egg of API Security

When Zero Trust was first described, a Sun Microsystems engineer used an analogy to describe the problem that is apt at this time of year. He called the reliance on firewalls “like a Cadbury egg.” A hard shell surrounds a soft center.

The Cadbury Egg analogy highlights the limitations of traditional perimeter-based security models. This is the critical issue that led to Zero Trust. In the days of firewalls, all traffic within the network was trusted by default once it passed through the perimeter security. This created a vulnerable environment where an attacker who managed to breach the firewall had unrestricted access to the internal resources.

This vulnerability continued to the early versions of Kubernetes and clusters. API gateways could act as hard shells, but once a request made it past the gateway, it had unrestricted access to all services within the cluster. This meant that if an attacker compromised a single service or gained unauthorized access to the cluster, they could move laterally and access other sensitive services and resources.

What is the answer here? There are two. The first is robust authentication. Robust authentication is a critical component of modern security architectures. It goes beyond simple username and password combinations and incorporates multiple factors to verify the identity of users attempting to access resources, such as:

1. Something they know: Passwords, PINs, or security questions.
2. Something they have: Physical tokens, smart cards, or mobile devices.
3. Something they are: Biometric data like fingerprints, facial recognition, or iris scans.

By combining multiple factors, robust authentication significantly reduces the risk of unauthorized access.

The second is Zero Trust. Zero Trust is a security model that assumes no implicit trust for any entity, whether inside or outside the network perimeter. It operates on the principle of "never trust, always verify," requiring continuous authentication, authorization, and validation of all access requests.

The traditional “Cadbury egg” network perimeter is no longer the primary security boundary in a Zero Trust architecture. Instead, the focus shifts to protecting individual resources, such as applications, services, and data, regardless of their location or the network they reside on.

The core principles of Zero Trust include:

1. Verify explicitly: Authenticate and authorize every access request based on multiple attributes, such as user identity, device health, and behavioral context.
2. Use least privilege access: Grant users the minimum access required to perform their tasks and continuously monitor and adjust access privileges based on changing circumstances.
3. Assume breach: Operate under the assumption that a breach is inevitable or has already occurred, and design security controls to minimize an attacker's impact and lateral movement.

In a Zero Trust model, every access request is treated as untrusted by default, regardless of whether it originates from inside or outside the network. This approach helps mitigate the risks associated with insider threats, compromised credentials, and lateral movement within the network.

Implementing Robust Authentication With Edge Stack to Support Zero Trust

Zero Trust relies on a combination of technologies and practices, including:

1. Robust authentication mechanisms, such as multi-factor authentication (MFA) and risk-based authentication.
2. Micro-segmentation of networks and resources to limit the blast radius of a potential breach.
3. Continuous monitoring and analysis of user behavior and device health to detect and respond to anomalies and threats.
4. Encryption of data in transit and at rest to protect sensitive information.
5. Automated policy enforcement and orchestration to ensure consistent security controls across the environment.

Edge Stack API Gateway is a core component of these, particularly the robust authentication mechanisms. With Edge Stack, you can integrate with identity providers (IdPs) to authenticate users using standard protocols like OAuth 2.0 and OpenID Connect. This ensures that only authenticated users can access your APIs.

In Edge Stack API Gateway, you do this through Filters. Filters allow you to intercept traffic before it gets sent to your service. For authentication, you could use an OAuth2 filter that would allow you to authenticate against an IdP. Here is how it would fit into your flow:

In Ambassador, an OAuth filter configuration can be as simple as:

---
apiVersion: getambassador.io/v3alpha1
kind: Filter
metadata:
  name: auth-filter
  namespace: default
spec:
  OAuth2:
    authorizationURL: PROVIDER_URL ## URL where Ambassador Edge Stack can find OAuth2 descriptor
    extraAuthorizationParameters:
      audience: AUDIENCE ## OIDC Audience
    clientID: CLIENT_ID ## OAuth2 client from your IdP
    secret: CLIENT_SECRET ## Secret used to access OAuth2 client
    protectedOrigins:
    - origin: AMBASSADOR_URL ## URL your IdP will redirect back to. Typically the same as the requests host.

You then create a FilterPolicy that calls the Filter above and applies it to the requested paths:

---
apiVersion: getambassador.io/v3alpha1
kind: FilterPolicy
metadata:
  name: httpbin-policy
  namespace: default
spec:
  rules:
    - host: "*"
      path: /httpbin/ip
      filters:
        - name: auth-filter ## Enter the Filter name from above
          arguments:
            scope:
            - "scopevalue1"
            - "scopevalue2"

Depending on your authentication provider, you can add more detail to these filters and policies (e.g., here is one for using SSO with Auth0), but the core idea is always the same.

But Edge Stack goes beyond just being a hard shell. The critical part of Zero Trust is that the security protocols extend beyond the perimeter. To work within the Zero Trust framework, Edge Stack API Gateway integrates with other components of your infrastructure to propagate the authenticated user identity and enable consistent security policies throughout your system.

• Edge Stack can work seamlessly with service meshes like Istio or Linkerd. You can enforce authorization policies at the individual service level by propagating the authenticated user identity to the service mesh. This allows you to control access to specific services based on the user's identity and role, ensuring that users can only access their authorized resources.
• Edge Stack supports mutual TLS (mTLS) authentication, establishing secure, encrypted communication channels between the API gateway and your upstream services. This adds an additional layer of authentication and ensures that only trusted services can interact with each other.

By adopting a Zero Trust approach, organizations can significantly enhance their security posture and reduce the risk of data breaches and unauthorized access to critical resources. It provides a more granular and adaptive security model that can adapt to modern software environments' dynamic and distributed nature.

By leveraging Edge Stack's authentication capabilities and integrating it with other security technologies like service meshes and mTLS, you can build a comprehensive Zero Trust architecture for your APIs. This approach eliminates the reliance on a single perimeter security layer and enables you to enforce security policies at multiple levels, from the API gateway to individual services.