AppSec & Microservices - Velocity 2016
5 likes4,658 views
This document appears to be a transcript from a presentation on application security and microservices. The summary includes: 1) The presentation discusses security challenges and strategies for microservices architectures, including transport security, authentication, authorization, encryption of data at rest, and perimeter security approaches. 2) Prevention, detection, response and recovery are emphasized as important aspects of a security strategy, along with practices like short-lived credentials, patching, and "repaving" or rebuilding systems on deployments. 3) Managing security risks across polyglot systems is highlighted as a challenge, as is the need to automate security practices and conduct thorough post-mortem analyses of incidents.
![@samnewman#velocityconf
"[The employee responsible] didn't follow
procedures and clearly that's not a good thing
but I wouldn't want to pre-empt the proper
investigation and we'll figure out what the right
response is when we've had a chance to dig into
the detail."
- Australian Financial Review
http://www.afr.com/business/telecommunications/telstra-mobile-network-down-across-
australia-reports-20160209-gmpaty](https://image.slidesharecdn.com/securing-microservicesvelocity-90mins-160623231002/85/AppSec-Microservices-Velocity-2016-148-320.jpg)
AppSec & Microservices - Velocity 2016
- 12. @samnewman#velocityconf Accounts Returns Invoicing Shipping Inventory Customer Service Small Independently Deployable services that work together, modelled around a business domain
- 30. @samnewman#velocityconf Open Safe Pick Lock Learn Combo Cut Open
- 31. @samnewman#velocityconf Open Safe Pick Lock Learn Combo Cut Open Find Written Combo Get Combo from the target
- 32. @samnewman#velocityconf Open Safe Pick Lock Learn Combo Cut Open Find Written Combo Get Combo from the target Blackmail Threaten Bribe
- 33. @samnewman#velocityconf Open Safe Pick Lock Learn Combo Cut Open Find Written Combo Get Combo from the target Blackmail Threaten Bribe Impossible Impossible Impossible Possible Possible Possible
- 34. @samnewman#velocityconf Open Safe Pick Lock Learn Combo Cut Open Find Written Combo Get Combo from the target Blackmail Threaten Bribe
- 35. @samnewman#velocityconf Open Safe Pick Lock Learn Combo Cut Open Find Written Combo Get Combo from the target Blackmail Threaten Bribe $$$$ $$$$ $$$$ $$ $$ $
- 40. BENEFITS OF HTTPS? ▫︎Server guarantees!
- 41. BENEFITS OF HTTPS? ▫︎Server guarantees! ▫︎Payload not manipulated…
- 42. BENEFITS OF HTTPS? ▫︎Server guarantees! ▫︎Payload not manipulated… ▫︎…but no client guarantee and…
- 43. BENEFITS OF HTTPS? ▫︎Server guarantees! ▫︎Payload not manipulated… ▫︎…but no client guarantee and… ▫︎…certificates can be a pain
- 49. CLIENT-SIDE CERTIFICATES? ▫︎Client guarantees! ▫︎…but a PITA to manage….
- 50. @samnewman#velocityconf http://techblog.netflix.com/2015/09/introducing-lemur.html
- 58. @samnewman#velocityconf Catalog service Music Web Shop Recommend service Royalty Payment Gateway Mobile app Web browsers User service Web browsers Form AuthOAuth PERIMETER SECURITY! User service
- 62. @samnewman#velocityconf Catalog service Music Web Shop Recommend service Mobile app Web browsers User service Web browsers User service Asking As Bob Can I see Alice’s Data?
- 63. @samnewman#velocityconf https://www.flickr.com/photos/lundyd/14481829564/ Confused Deputy Problem!
- 67. @samnewman#velocityconf Music Web Shop Web browsers User service { "id": "402ndj39", "name": “Alice Alison" }
- 68. @samnewman#velocityconf Music Web Shop Web browsers User service { "id": "402ndj39", "name": “Alice Alison" }
- 69. @samnewman#velocityconf Music Web Shop Web browsers User service { "id": "402ndj39", "name": “Alice Alison" }
- 76. @samnewman#velocityconf “In the API server secret data is stored as plaintext in etcd" http://kubernetes.io/docs/user-guide/secrets/#security-properties
- 84. @samnewman#velocityconf S/M TestsBuild Large Tests Production
- 85. @samnewman#velocityconf S/M TestsBuild Large Tests Production Security?
- 86. @samnewman#velocityconf S/M TestsBuild Large Tests Production Security? OWASP ZAP Attack Proxy Static Analysers
- 89. @samnewman#velocityconf “At or near the top of security concerns in the datacenter is something called an Advanced Persistent Threat (APT). An APT gains unauthorized access to a network and can stay hidden for a long period of time. Its goal is usually to steal, corrupt, or ransom data.” - Justin Smith, Pivotal
- 91. @samnewman#velocityconf Rotate: Short-lived Credentials Repair: Patch Your Stuff
- 92. @samnewman#velocityconf Rotate: Short-lived Credentials Repave: Burn It Down! Repair: Patch Your Stuff
- 95. @samnewman#velocityconf (don’t forget to limit credential scope too)
- 106. @samnewman#velocityconf Catalog service Music Web Shop Recommend service Royalty service Mobile app Web browsers User service PERIMETER SECURITY! PERIMETER SECURITY! PERIMETERSECURITY!
- 107. @samnewman#velocityconf Polyglot = more stuff to track!
- 115. @samnewman#velocityconf Repair: Patch Your Stuff Automate it
- 116. @samnewman#velocityconf Repair: Patch Your Stuff Automate it Do It A Lot
- 117. @samnewman#velocityconf Repair: Patch Your Stuff Automate it Do It A Lot And Check Your Work
- 119. @samnewman#velocityconf Polyglot = more things to break?
- 138. @samnewman#velocityconf Repave: Burn It Down!
- 141. @samnewman#velocityconf Phoenix Servers Immutable Servers = repave on every release
- 142. @samnewman#velocityconf Why not repave automatically when you apply a patch?
- 145. @samnewman#velocityconf Harder with microservices? RepaveBackups AUTOMATE ALL THE THINGS
- 148. @samnewman#velocityconf "[The employee responsible] didn't follow procedures and clearly that's not a good thing but I wouldn't want to pre-empt the proper investigation and we'll figure out what the right response is when we've had a chance to dig into the detail." - Australian Financial Review http://www.afr.com/business/telecommunications/telstra-mobile-network-down-across- australia-reports-20160209-gmpaty
- 151. @samnewman#velocityconf “Finding the root cause of a failure is like finding a root cause of a success.” http://www.kitchensoap.com/2012/02/10/each-necessary-but-only-jointly-sufficient/ John Allspaw
- 153. @samnewman#velocityconf Don’t forget to review your old post-mortems too…
- 154. @samnewman#velocityconf Don’t forget to review your old post-mortems too… …and the resulting action plans!
- 156. @samnewman#velocityconf Sam Newman Building Microservices DESIGNING FINE-GRAINED SYSTEMS http://buildingmicroservices.com/
- 157. @samnewman#velocityconf Sam Newman Building Microservices DESIGNING FINE-GRAINED SYSTEMS http://buildingmicroservices.com/ http://samnewman.io/
- 158. @samnewman#velocityconf Sam Newman Building Microservices DESIGNING FINE-GRAINED SYSTEMS http://buildingmicroservices.com/ http://magpietalkshow.com/ http://samnewman.io/
- 159. @samnewman#velocityconf Wednesday 22nd Sam Newman Building Microservices DESIGNING FINE-GRAINED SYSTEMS Signing 5.45pm @ Oreilly Booth