AI
Why security layers exist — and who is responsible for each
Cozma and Hodoroabă split security into six layers: edge and perimeter, network and API management, service communication, state and data, and observability. The outer two, edge and network, can belong to a dedicated security team or a managed service. The inner layers, starting with service communication, shift responsibility squarely onto developers. As Cozma put it:
“No single layer can protect everything. You need to have collaboration between layers.” — Alexandru Cozma
Failing at the data layer is the worst outcome. Downtime is recoverable. Lost trust is not.
Edge and perimeter defenses: browser, DNS, DDoS, WAF, and bot management
The browser is the first checkpoint. CSRF tokens, Content Security Policy, subresource integrity hashes, and cross-origin opener policies all run here. They don’t help if the workstation is already compromised, but they cover the common cases. A DNS firewall blocks malicious domains before a connection opens. DDoS protection keeps the app reachable. A CDN hides the origin IP. A WAF filters SQL injection and XSS before traffic arrives.
Bot management is the layer most likely to change. CAPTCHA puzzles are the current form. With LLM agents making requests that look human, that layer will need a rethink.
Network, API gateways, and user authentication
The firewall at this layer has two rules: drop everything, accept traffic only from a defined source. API management sits on top of that, handling layer 7 checks, authentication, authorization, and license controls — the line that stops brute-force attempts before they reach application code. The ingress gateway, whether an Nginx controller in a Kubernetes cluster or a dedicated service, terminates TLS, handles reverse proxying, and can serve as the entry point into a zero-trust architecture.
User authentication spans passwords and TOTP codes up through FIDO2 passkeys and implicit authentication, where the system checks typing cadence and gait sensor data without the user knowing a check is happening. Authorization layers RBAC with resource-based and attribute-based controls. SSO and federation extend that across services, so an employee who authenticates to Outlook moves to the next app without a second login prompt.
Service-to-service security: mutual TLS, service mesh, and message brokers
User authentication covers humans. Services need separate trust. A service mesh encrypts internal traffic; mutual TLS requires each service to present a client certificate to the next, with single-use certificates possible. Policy rules cap which services each caller can reach. Message brokers carry the same risk: without per-service credentials, a message meant for Coca-Cola can reach Pepsi. Cozma’s team assigns a separate credential to every service, encrypts messages in transit, and signs them so a compromised node inside the cluster cannot forge a publication.
“In security the main coin to exchange is trust. You don’t trust it, you don’t go there.” — Alexandru Cozma
Data layer: tenant segregation strategies and credential rotation
Four isolation models exist for tenant data: one shared table filtered by username (Gmail’s approach), per-tenant tables, dedicated databases, or dedicated clusters. Cozma’s team chose dedicated databases as default, with dedicated clusters sold as a premium tier for large customers who pay more to avoid sharing CPU, memory, and storage. Each tenant gets unique database credentials, rotated every 30 days. Certificates follow the same 30-day schedule today, dropping to six days next year as quantum decryption pressure forces shorter windows. Memory caches get the same treatment: tenant data in Dragonfly is segregated by organization, encrypted at rest, and credentials rotate on the same 30-day cycle.
Observability and incident response as the cross-cutting safety net
Observability sits across every other layer, not after them. Telemetry collects logs, metrics, and distributed traces. SIEM tools and anomaly detection watch for deviations: normal morning logins followed by authentication failures at 3 a.m. is a signal, not noise. When that fires, automated playbooks run the same way a pilot manual handles error 647 — specific steps, no improvisation. Escalation paths kick in if the playbook doesn’t resolve it. Then forensics closes the loop, tracing exactly which layers the attacker moved through so the same path can’t be used twice.
“No single layer can protect everything. You need to have collaboration between layers.” — Alexandru Cozma
Q&A
Proxy at the firewall level versus a dedicated tool for DLP — which is better, and does it matter for end users? Both matter, but the speaker noted that 50% of their data center customers run software 3 years out of date, and most end users don’t understand proxies well enough to run one, so the value is real but adoption is the limiting factor. ▶ 35:42
How much would you insist on identity-based firewall access versus traditional IP-based access for a private network? Use both: the team treats everything at layer 4 and below as one attack domain and everything above layer 7 as another, applying controls at each, though current service meshes can’t yet integrate with IDPs such as Elo, so lower-level gear still falls back to IP-based approaches like Kerberos. ▶ 38:40
On memory cache encryption — do you have production recommendations, and how do you handle key rotation without destroying cache performance? They use one of the fastest available encryption algorithms with a short key and rotate every 12 hours, accepting that rotation invalidates the entire cache, trading cache warmth for security because their customers prefer a 2-second load over an instant but compromised one. ▶ 42:30
Could paid services like IPS, DNS filtering, and web filtering alleviate the need to harden other layers? Partially, but the co-speaker argued every layer still needs a minimum baseline — pointing to a recent incident where a Jira instance exposed to the internet with only username/password authentication was breached, which MFA alone would have stopped. ▶ 44:22
Notable Quotes
No single layer can protect everything. You need to have collaboration between layers. Alexandru Cozma · ▶ 4:59
In security the main coin to exchange is trust. You don’t trust it, you don’t go there. Alexandru Cozma · ▶ 7:26
Do you trust your users? Never. Alexandru Cozma · ▶ 38:15
all those security layers brings a lot of latency in the end. But it in our case data center equipment and the business of our customers it’s better to load in two seconds than instant Alexandru Cozma · ▶ 43:46
Key Takeaways
- Layer security from the browser inward — no single checkpoint can carry the full load.
- Isolate tenant data by dedicated database or cluster, not just by column filter, then rotate credentials every 30 days or less.
- Deploy observability across every layer so anomalies surface in time to trigger automated playbooks before humans wake up.
About the Speakers
Alexandru Cozma
With a passion for Lego Star Wars sets, Alex began his career at IBM 11 years ago, eventually transitioning to Lenovo through the acquisition of the DataCenter business. Over the years, Alex has specialized in large-scale system management, datacenter security, and cloud, hybrid, and private applications. Currently, Alex is focused on developing a competitive solution for Lenovo that enables cloud-hybrid datacenter management, turning the once-taboo concept of managing servers from the cloud into a reality. Recently, Alex has achieved significant milestones, becoming one of the youngest Principal Engineers and earning the title of Master Inventor.
Tiberius Hodoroabă
Cybersecurity Engineer, ex-Mathematics and Computer Science teacher, both in the Romanian and international system, oscillating between the city and the countryside since 1992. Chronic astrophile (a “disease” cured solely by stars and galaxies), on-demand chef, photographer’s assistant when necessary, tornado hunter in an alternate existence. Avid science-fiction reader, lover of classical music, black tea and van travels.