Security in Ambassador: A risk-based approach

Threats, vulnerabilities, and risk — not the same thing

Many years ago, when I ran product at Rapid7, we emphasized the differences between threats, vulnerability, and risk. We knew that every system has vulnerabilities, and we wanted to make sure our customers didn’t deploy security programs that solely focused on mitigating vulnerabilities. After all, the goal of a security program is to reduce risk.

So what’s the difference between threats, vulnerabilities, and risk?

• A threat is an entity that can exploit a vulnerability. Threats can be intentional or accidental.
• A vulnerability is a known weakness in a system or program that can be exploited by threats.
• Risk is the intersection of threats and vulnerabilities — it is the potential for loss, damage, or destruction as a result of a threat exploiting a vulnerability.

Ambassador security and risk

We’ve carried over this philosophy to Ambassador, and we take a risk-based approach to security. We believe that security is an ongoing process, and that the strength (or weakness) of Ambassador is dependent on our security process. As such, our security process includes:

• Understanding and evolving our threat model, as we learn more
• Defensive coding practices to minimize introducing security vulnerabilities during the development process
• Proactively identifying vulnerabilities through architecture reviews, code scanning, code reviews, and independent audits
• Rigorous automated testing and release processes so that we can efficiently ship updates as security vulnerabilities are discovered and disclosed
• Adopting defensive deployment strategies

We’re augmenting our security process with independent third party verification and penetration testing, which has helped us identify additional areas for improving our process and software.

Envoy Proxy vulnerabilities

Envoy’s rapidly growing adoption has resulted in greater scrutiny of the Envoy code base. The Envoy Security team has done a terrific job of identifying and resolving vulnerabilities. We expect that new vulnerabilities will continue to be discovered. We are committed to shipping Ambassador API Gateway and Edge Stack updates in a timely fashion (see the recent 1.2.1 and 1.5.2 releases for examples).

Submitting potential security issues

If you have identified a potential security issue, please do not file a GitHub issue. Instead, contact us privately at secalert@datawire.io.