Skip to content

Securing Distributed Cache: Achieving Secure-by-Default with Key Challenges & Insights#

SREcon25 Americas digest Program Core pick 25–27 March 2025

Recording

Akashdeep Goel, Sriram Rangarajan, and Samuel Fu, Netflix — Core

Play the recording: Securing Distributed Cache: Achieving Secure-by-Default with Key Challenges Insights

  • Why: A concrete account of retrofitting security (cert lifecycle management, secured proxy calls for polyglot clients) onto an already-massive production system — 400M requests/sec, 14PB of data — rather than designing it in from day one, which is the situation most real security-hardening projects actually face.
  • What: How Netflix secured its multi-region distributed caching system (used for both streaming and gaming workloads) after the fact, covering certificate lifecycle management, eliminating spurious policy lookup calls, and securing proxy calls across clients written in different languages. (from abstract only)
  • How: Debugged and validated using CPU profiling and memory dumps to find the performance/correctness cost of retrofitted security controls, then executed a global-scale rollout. (from abstract only)
  • Where applicable: General for retrofitting security/mTLS-style controls onto an existing high-throughput distributed system; the polyglot-client proxy-securing pattern is broadly applicable beyond caching specifically.