appsec & microservices - velocity 2016

APPSEC & MICROSERVICESSam Newman Velocity 2016

@samnewman#velocityconf


Sam Newman

Building MicroservicesDESIGNING FINE-GRAINED SYSTEMS


Microservices Can Make Everything Worse

@samnewman#velocityconfhttps://www.flickr.com/photos/seattlemunicipalarchives/4058808950

@samnewman#velocityconf https://www.flickr.com/photos/theseanster93/485390997/


http://map.norsecorp.com/


Accounts

Returns

Invoicing

Shipping

Inventory

Customer Service


Accounts

Returns

Invoicing

Shipping

Inventory

Customer Service

Small Independently Deployable services that work together, modelled

around a business domain

https://www.flickr.com/photos/wwworks/2607036664/

https://www.flickr.com/photos/lkowen/15803718243/


Prevention


Prevention Detection



Response



ResponseRecovery

@samnewman#velocityconf https://www.flickr.com/photos/adulau/15680439035/

@samnewman#velocityconf https://www.flickr.com/photos/duanestorey/469163789/


https://www.schneier.com/paper-attacktrees-ddj-ft.html


Open Safe


Open Safe

Pick Lock Learn Combo Cut Open


Open Safe


Find Written Combo

Get Combo from the target


Open Safe


Find Written Combo


Blackmail Threaten Bribe


Open Safe


Find Written Combo



Impossible

Impossible ImpossiblePossible

Possible

Possible


Open Safe


Find Written Combo




Open Safe


Find Written Combo



$$$$

$$$$ $$$$$$

$$

$


Catalog service

Music Web Shop

Recommend service

Royalty Payment Gateway

Mobile app

Web browsers

User service


Catalog service

Music Web Shop

Recommend service


Mobile app

Web browsers

User service

Transport Security


HTTPS Everywhere!

BENEFITS OF HTTPS?

BENEFITS OF HTTPS?

▫︎ Server guarantees!

BENEFITS OF HTTPS?


▫︎ Payload not manipulated…

BENEFITS OF HTTPS?



▫︎…but no client guarantee and…

BENEFITS OF HTTPS?



▫︎…but no client guarantee and…

▫︎…certificates can be a pain


https://letsencrypt.org/

Catalog service

Music Web Shop

Recommend service


Mobile app

Web browsers

User service

CLIENT-SIDE CERTIFICATES?


▫︎Client guarantees!


▫︎Client guarantees!

▫︎…but a PITA to manage….


http://techblog.netflix.com/2015/09/introducing-lemur.html


Catalog service

Music Web Shop

Recommend service


Mobile app

Web browsers

User service


Auth?


Auth?

Authentication


Auth?

Authentication Authorisation


Catalog service

Music Web Shop

Recommend service


Mobile app

Web browsers

User service

Web browsers


Catalog service

Music Web Shop

Recommend service


Mobile app

Web browsers

User service

Web browsers

Form AuthOAuth


Catalog service

Music Web Shop

Recommend service


Mobile app

Web browsers

User service

Web browsers

Form AuthOAuthPERIMETER SECURITY!


Catalog service

Music Web Shop

Recommend service


Mobile app

Web browsers

User service

Web browsers

Form AuthOAuthPERIMETER SECURITY!

User service


Music Web Shop

User serviceUser

service

Implicit Trust?


Catalog service

Music Web Shop

Recommend service

Mobile app

Web browsers

User service

Web browsers

User service


Catalog service

Music Web Shop

Recommend service

Mobile app

Web browsers

User service

Web browsers

User service

Asking As Bob


Catalog service

Music Web Shop

Recommend service

Mobile app

Web browsers

User service

Web browsers

User service

Asking As Bob

Can I see Alice’s Data?

@samnewman#velocityconf https://www.flickr.com/photos/lundyd/14481829564/

Confused Deputy

Problem!


Music Web Shop

Web browsers

User service


Music Web Shop

Web browsers

User service

{ "id": "402ndj39", "name": “Alice Alison" }


Data At Rest?


Catalog service

Music Web Shop

Recommend service


Mobile app

Web browsers

User serviceUser

service


Encryption!

@samnewman#velocityconf https://www.flickr.com/photos/aigle_dore/2781302649

https://www.flickr.com/photos/aigle_dore/2781302649


Plain Text?


“In the API server secret data is stored as plaintext in etcd"

http://kubernetes.io/docs/user-guide/secrets/#security-properties


Secure Vaults


Aside: Docker


http://www.banyanops.com/blog/analyzing-docker-hub/


S/M TestsBuild Large Tests Production



Security?



Security?

OWASP ZAP Attack ProxyStatic Analysers

@samnewman#velocityconf https://www.microsoft.com/en-us/sdl/


https://medium.com/built-to-adapt/the-three-r-s-of-enterprise-security-rotate-repave-and-repair-f64f6d6ba29d

https://medium.com/built-to-adapt/the-three-r-s-of-enterprise-security-rotate-repave-and-repair-f64f6d6ba29d


“At or near the top of security concerns in the datacenter is something called an Advanced Persistent Threat (APT). An APT gains unauthorized access to a network and can stay hidden for a long period of time. Its goal is usually to steal, corrupt, or ransom data.”

- Justin Smith, Pivotal


Rotate: Short-lived Credentials



Repair: Patch Your Stuff



Repave: Burn It Down!



http://www.theregister.co.uk/2014/06/18/code_spaces_destroyed/


https://github.com/michenriksen/gitrob


(don’t forget to limit credential scope too)



ResponseRecovery

@samnewman#velocityconfhttps://www.qualys.com/research/top10/


http://www.extremetech.com/computing/190959-shellshock-a-deadly-new-vulnerability-that-could-lay-waste-to-the-internet


https://www.modsecurity.org/


Catalog service

Music Web Shop

Recommend service

Royalty service

Mobile app

Web browsers

User service


Catalog service

Music Web Shop

Recommend service

Royalty service

Mobile app

Web browsers

User service

PERIMETER SECURITY!


Catalog service

Music Web Shop

Recommend service

Royalty service

Mobile app

Web browsers

User service

PERIMETER SECURITY!

PERIMETER SECURITY!


Catalog service

Music Web Shop

Recommend service

Royalty service

Mobile app

Web browsers

User service

PERIMETER SECURITY!

PERIMETER SECURITY!

PERIMETER SECU

RITY!


Polyglot = more stuff to track!


https://www.npmjs.com/package/npm-check


b4a2f5ga2

4335egad3

ab2d56be3

847ea3dbe


b4a2f5ga2

4335egad3

ab2d56be3

847ea3dbe !!!

!!!


b4a2f5ga2

4335egad3

ab2d56be3

847ea3dbe

847ea3dbe

847ea3dbe

847ea3dbe

4335egad34335egad3

4335egad3

4335egad3

4335egad3

4335egad3

4335egad3

4335egad3

4335egad3

4335egad3

4335egad3

847ea3dbe

!!!

!!!


https://github.com/coreos/clair



Automate it



Automate it

Do It A Lot



Automate it

Do It A Lot

And Check Your Work


Polyglot = more things to break?



ResponseRecovery

@samnewman#velocityconf http://krebsonsecurity.com/tag/target-data-breach/


Comms

@samnewman#velocityconfhttps://en.wikipedia.org/wiki/Chicago_Tylenol_murders


Customer



ResponseRecovery


Backups


Repave: Burn It Down!


Phoenix Servers


Phoenix Servers

Immutable Servers


Phoenix Servers

Immutable Servers= repave on every release


Why not repave automatically when you apply a patch?


RepaveBackups


Harder with microservices?

RepaveBackups


Harder with microservices?

RepaveBackups

AUTOMATE ALL THE THINGS


Post Mortems


http://www.smh.com.au/digital-life/mobiles/telstra-outage-manager-connected-customers-to-faulty-node-in-embarrassing-error-20160209-gmpn7f.html


"[The employee responsible] didn't follow procedures and clearly that's not a good thingbut I wouldn't want to pre-empt the proper investigation and we'll figure out what the right response is when we've had a chance to dig into the detail." - Australian Financial Review

http://www.afr.com/business/telecommunications/telstra-mobile-network-down-across-australia-reports-20160209-gmpaty

http://www.afr.com/business/telecommunications/telstra-mobile-network-down-across-australia-reports-20160209-gmpaty


http://samnewman.io/blog/2016/02/10/telstra_outage/


https://vimeo.com/102167635


“Finding the root cause of a failure is like finding a root cause of a success.”

http://www.kitchensoap.com/2012/02/10/each-necessary-but-only-jointly-sufficient/

John Allspaw


http://www.smh.com.au/technology/technology-news/telstra-free-data-guy-clocks-up-almost-a-terabyte-of-downloads-20160404-gnxu14.html


Don’t forget to review your old post-mortems too…


Don’t forget to review your old post-mortems too…

…and the resulting action plans!



ResponseRecovery


Sam Newman


http://buildingmicroservices.com/


Sam Newman



http://samnewman.io/


Sam Newman



http://magpietalkshow.com/

http://samnewman.io/


Wednesday 22nd

Sam Newman


Signing

5.45pm

@ Oreilly Booth

@samnewman [email protected]

THANKS!

mailto:[email protected]

appsec & microservices - velocity 2016

Software