Security in depth is just not a thing a lot of people think about right now.
Tunnelling Redis protocol over mutual TLS or something like that sounds like a good idea, but I don't think I've seen anyone doing that :(
Frankly, I would love it if there were a simple, open standard for authentication so every database didn't have to redo it. Maybe mutual TLS is that answer, though traditionally getting the infrastructure for that correct has been difficult.
There is: https://en.wikipedia.org/wiki/Simple_Authentication_and_Secu...
And as you said, nobody bothers to tunnel with TLS. Your lucky if they even use a password.
- Has practically nothing other than Redis on it.
- Has Redis running with minimal permissions and capabilities.
- Has no ability to make outgoing connections.
Which I'd say is vital security practice for anything running in production.
Few people will bother with TLS and you can see that based on the fact that I don't think cloud providers generally support it, but I personally did do this with stunnel at a time. Apparently Redis now recommends spiped, which looks good to me.
I think the only concern is where the software listens by default. If it's TCP 0.0.0.0/[::] then someone's eventually going to make a mistake.
In my opinion network ACLs are a pretty important part of a modern defense in depth, though you are absolutely right in that these measures are far from a panacea and usually only slow down horizontal movement.