OWASP AppSecEu 2016 Rome - Building secure cloud native apps
1 like234 views
The document discusses building secure cloud-native applications with Spring Boot and Spring Security. It introduces Spring Security which provides "secure by default" configurations and password encoding. It also discusses secure microservice architectures using OAuth2 for authentication and authorization between services. Runtime application self-protection with AppSensor is presented as another method for securing cloud applications.
OWASP AppSecEu 2016 Rome - Building secure cloud native apps
- 1. Andreas Falk Building secure cloud-native apps with spring boot & security
- 2. About me Building secure cloud-native apps with spring boot & security 2 Andreas Falk / Germany NovaTec Consulting GmbH andreas.falk@novatec-gmbh.de @Agile_Security Agile Threat Modeling Cloud Spring Security Scrum Kanban TDD Code Review CleanCode Static Analysis Architecture OWASP Java EE Microservices IoT BDD DevOps Web Java SSO OAuth2 SAML
- 3. Developers vs. Security Building secure cloud-native apps with spring boot & security 3 Java
- 4. Developers vs. Security Building secure cloud-native apps with spring boot & security 4 Cloud IoT Microservices BigDataSingle Page Apps Testing NoSQL DevOps Agile Cross-Functional Security? Java8
- 5. Secure Web Application in 5 minutes Building secure cloud-native apps with spring boot & security 5 Live Coding Demo
- 6. Cloud Native Building secure cloud-native apps with spring boot & security 6
- 7. Cloud Native Building secure cloud-native apps with spring boot & security 7 DevOps Continuous Delivery Microservices Containers Culture Process Architecture Technology
- 8. JP Morgan Chase‘s Cloud Native MM Building secure cloud-native apps with spring boot & security 8 Cloud NativeLevel 3 Cloud ResilientLevel 2 Cloud FriendlyLevel 1 Cloud ReadyLevel 0
- 9. JP Morgan Chase‘s Cloud Native MM Building secure cloud-native apps with spring boot & security 9 Cloud NativeLevel 3 Cloud ResilientLevel 2 Cloud FriendlyLevel 1 Cloud ReadyLevel 0 12 Factor App One Code Base Externalize Configuration … http://12factor.net
- 10. Process ProcessProcess From Monolith To Microservices Building secure cloud-native apps with spring boot & security 10 Process Process Java Process C# Process Python Process Java
- 11. Microservice = Spring Boot Standalone Spring Apps Auto Configuration Embedded Servlet Container „Make JAR Not WAR“ Production-Ready Features Building secure cloud-native apps with spring boot & security 11
- 12. Cloud Native Building secure cloud-native apps with spring boot & security 12 Secure
- 13. Secure Continuous Delivery ? Building secure cloud-native apps with spring boot & security 13 Time Attacks (24x7) Deployments Penetration Test Sprint Sprint Sprint Sprint Sprint Sprint
- 14. Agile Security / SecDevOps Building secure cloud-native apps with spring boot & security Sprint Releasable Increment Ops / SupportProduct Backlog Continuous Delivery Vision + Security 14 Today‘s Session !!!
- 15. Secure Cloud-Native Applications Secure + Cloud-Native Building secure cloud-native apps with spring boot & security 15 Spring Security + Spring Boot =
- 16. Spring Security „Secure By Default“ Configuration Authentication / Authorization Secure Password Encoding Testing Support Building secure cloud-native apps with spring boot & security 16
- 17. „Secure By Default“ Configuration Require Authentication for all URLs: On Session Fixation Protection: On Session Cookie (HttpOnly, Secure): On CSRF Attack Protection: On Security Response Headers: On Building secure cloud-native apps with spring boot & security 17 Java
- 18. Security Response Headers Building secure cloud-native apps with spring boot & security 18 Cache Control X-Content-Type-Options X-Frame-Options X-XSS-Protection HTTP Strict Transport Security (SSL)
- 19. Secure Password Encoding public interface PasswordEncoder { String encode(CharSequence rawPassword); boolean matches( CharSequence rawPassword, String encodedPassword); } Building secure cloud-native apps with spring boot & security 19 Java
- 20. Secure Password Encoding public interface PasswordEncoder { String encode(CharSequence rawPassword); boolean matches( CharSequence rawPassword, String encodedPassword); } Building secure cloud-native apps with spring boot & security 20 Java Encoder Implementations BCryptPasswordEncoder SCryptPasswordEncoder Pbkdf2PasswordEncoder BytesEncryptor (implementation for BouncyCastle)
- 21. „Secure By Default“ Conventions Building secure cloud-native apps with spring boot & security 21 Live Coding Demo
- 22. Secure Cloud Architectures Building secure cloud-native apps with spring boot & security 22 Microservice API-Gateway Microservice Microservice UI
- 23. Secure Cloud with OAuth2 Building secure cloud-native apps with spring boot & security 23 Microservice API-Gateway Microservice Microservice UI OAuth2 Token Token Token Token Token OAuth2 Client Authorization Server Resource Server
- 24. Secure Cloud with OAuth2 Building secure cloud-native apps with spring boot & security 24 Microservice API-Gateway Microservice Microservice UI OAuth2 Token Token Token Token Token OAuth2 Client Authorization Server Resource Server More Details on OAuth2: Session on OpenId Connect earlier today @AppSecEU
- 25. Tweetable OAuth2 Application Building secure cloud-native apps with spring boot & security 25 Java
- 26. Secure Microservices With OAuth2 Building secure cloud-native apps with spring boot & security 26 Live Coding Demo
- 27. Runtime Application Self-Protection Building secure cloud-native apps with spring boot & security 27
- 28. RASP With AppSensor Building secure cloud-native apps with spring boot & security 28 http://appsensor.org https://github.com/jtmelton/appsensor Cloud Native App AppSensor Integration 1: Event 3: Response 2: Attack AppSensor UI Analytics Policy Detection Points
- 29. AppSensor UI Building secure cloud-native apps with spring boot & security 30
- 30. AppSensor UI Building secure cloud-native apps with spring boot & security 31
- 31. AppSensor UI Building secure cloud-native apps with spring boot & security 32
- 32. Wrap Up: Secure Cloud-Native Apps Building secure cloud-native apps with spring boot & security 33 WebCloud Spring Security Spring Boot Spring IO Platform Spring Security OAuth2 Spring Cloud R A S P
- 33. Wrap Up: Secure Cloud-Native Apps Building secure cloud-native apps with spring boot & security 34 „Secure By Default“ Conventions !! „Secure By Default“ Developer API‘s !! Java
- 34. Questions? Building secure cloud-native apps with spring boot & security 35 Andreas Falk NovaTec Consulting GmbH andreas.falk@novatec-gmbh.de @Agile_Security https://github.com/andifalk/appseceu2016 http://projects.spring.io/spring-security http://projects.spring.io/spring-security-oauth