# security policy

Published articles for security policy.

This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles.

## Large Scale Security Policy Performance Tests

DevFeed: [Large Scale Security Policy Performance Tests](<https://devfeed.tech/articles/large-scale-security-policy-performance-tests-48710.md>)

Original publisher: [Read original article](<https://istio.io/latest/blog/2020/large-scale-security-policy-performance-tests/>)

Author: Michael Eizaguirre (Google), Yangmin Zhu (Google), Carolyn Hu (Google)

Published: 2020-09-15T00:00:00Z

Content type: article

Language: en

Sources: [Istio Blog](<https://devfeed.tech/sources/istio-blog.md>)

Topics: [istio](<https://devfeed.tech/topics/istio.md>), [Security](<https://devfeed.tech/topics/security.md>), [Latency](<https://devfeed.tech/topics/latency.md>), [benchmarking](<https://devfeed.tech/topics/benchmarking.md>), [Authorization](<https://devfeed.tech/topics/authorization.md>), [rbac](<https://devfeed.tech/topics/rbac.md>), [Architecture & Design](<https://devfeed.tech/topics/architecture-design.md>)

Tags: [authorization](<https://devfeed.tech/tags/authorization.md>), [benchmarking](<https://devfeed.tech/tags/benchmarking.md>), [concurrent](<https://devfeed.tech/tags/concurrent.md>), [envoy](<https://devfeed.tech/tags/envoy.md>), [latency](<https://devfeed.tech/tags/latency.md>), [mesh](<https://devfeed.tech/tags/mesh.md>), [microservices](<https://devfeed.tech/tags/microservices.md>), [performance](<https://devfeed.tech/tags/performance.md>), [performance-tests](<https://devfeed.tech/tags/performance-tests.md>), [rbac](<https://devfeed.tech/tags/rbac.md>), [security](<https://devfeed.tech/tags/security.md>), [security-policy](<https://devfeed.tech/tags/security-policy.md>), [services](<https://devfeed.tech/tags/services.md>), [test](<https://devfeed.tech/tags/test.md>), [tls](<https://devfeed.tech/tags/tls.md>)

### AI overview

Istio performance tests examine how security policies affect request latency, memory usage, and CPU usage. The tests cover mutual TLS, authorization and authentication policies, RBAC rules, and different request loads.

### Source excerpt

Overview Istio has a wide range of security policies which can be easily configured into systems of services. As the number of applied policies increases, it is important to understand the relationship of latency, memory usage, and CPU usage of the system. This blog post goes over common security policies use cases and how the number of security policies or the number of specific rules in a security policy can affect the overall latency of requests. Setup There are a wide range of security policies and many more combinations of those policies. We will go over 6 of the most commonly used test cases. The following test cases are run in an environment which consists of a Fortio client sending requests to a Fortio server, with a baseline of no Envoy sidecars deployed. The following data was gathered by using the Istio performance benchmarking tool. In these test cases, requests either do not match any rules or match only the very last rule in the security policies. This ensures that the RBAC filter is applied to all policy rules, and never matches a policy rule before before viewing all the policies. Even though this is not necessarily what will happen in your own system, this policy setup provides data for the worst possible performance of each test case. Test cases Mutual TLS STRICT vs plaintext. A single authorization policy with a variable number of principal rules as well as a PeerAuthentication policy. The principal rule is dependent on the PeerAuthentication policy being applied to the system. A single authorization policy with a variable number of requestPrincipal rules as well as a RequestAuthentication policy. The requestPrincipal is dependent on the RequestAuthentication policy being applied to the system. A single authorization policy with a variable number of paths vs sourceIP rules. A variable number of authorization policies consisting of a single path or sourceIP rule. A single RequestAuthentication policy with variable number of JWTRules rules. Data The