Threat aware service mesh

A computer-implemented method for providing a threat aware service mesh, comprising:

• extending the threat aware service mesh with a service mesh Application Programming Interface (API) and threat model management system in a control plane of the threat aware service mesh;
• automatically re-arranging a network policy related to a given service responsive to a high severity vulnerability above a threshold and an associated threat probability being marked against the given service;
• performing a threshold based optimization of removing a particular service from a network policy allowed list responsive to one or more threats against the particular service at one of more different threat levels above a threshold;
• and
• assigning default not-allowed policies and only allowing access to restricted services for trust boundaries marked in a threat model of the threat aware service mesh.

A computer program product for providing a threat aware service mesh, the computer program product comprising a non-transitory computer readable storage medium having program instructions embodied therewith, the program instructions executable by a computer to cause the computer to perform a method comprising:

• extending, by a hardware processor of the computer, the threat aware service mesh to accept, in a control plane of the threat aware service mesh, a plugin threat modeling management resource for managing threat model details;
• automatically re-arranging, by the hardware processor, a network policy related to a given service responsive to a high severity vulnerability above a threshold and an associated threat probability being marked against the given service;
• performing, by the hardware processor, a threshold based optimization of removing a particular service from a network policy allowed list responsive to one or more threats against the particular service at one of more different threat levels above a threshold;
• and
• assigning, by the hardware processor, default not-allowed policies and only allowing access to restricted services for trust boundaries marked in a threat model of the threat aware service mesh.