microservices - · pdf file(stateless) user_db microservices have their own data store...
TRANSCRIPT
![Page 1: Microservices - · PDF file(stateless) user_db Microservices have their own data store “Let the need-to-know principle ... • Authentication • Authorisation • Logging & Auditing](https://reader033.vdocuments.us/reader033/viewer/2022051718/5a723b437f8b9abb538d5d19/html5/thumbnails/1.jpg)
![Page 2: Microservices - · PDF file(stateless) user_db Microservices have their own data store “Let the need-to-know principle ... • Authentication • Authorisation • Logging & Auditing](https://reader033.vdocuments.us/reader033/viewer/2022051718/5a723b437f8b9abb538d5d19/html5/thumbnails/2.jpg)
Microservices –a security nightmare?
GOTO Nights Zürich - March 3, 2016
Maximilian Schöfmann | @schoefmann
Container Solutions Switzerland
![Page 3: Microservices - · PDF file(stateless) user_db Microservices have their own data store “Let the need-to-know principle ... • Authentication • Authorisation • Logging & Auditing](https://reader033.vdocuments.us/reader033/viewer/2022051718/5a723b437f8b9abb538d5d19/html5/thumbnails/3.jpg)
![Page 4: Microservices - · PDF file(stateless) user_db Microservices have their own data store “Let the need-to-know principle ... • Authentication • Authorisation • Logging & Auditing](https://reader033.vdocuments.us/reader033/viewer/2022051718/5a723b437f8b9abb538d5d19/html5/thumbnails/4.jpg)
![Page 5: Microservices - · PDF file(stateless) user_db Microservices have their own data store “Let the need-to-know principle ... • Authentication • Authorisation • Logging & Auditing](https://reader033.vdocuments.us/reader033/viewer/2022051718/5a723b437f8b9abb538d5d19/html5/thumbnails/5.jpg)
![Page 6: Microservices - · PDF file(stateless) user_db Microservices have their own data store “Let the need-to-know principle ... • Authentication • Authorisation • Logging & Auditing](https://reader033.vdocuments.us/reader033/viewer/2022051718/5a723b437f8b9abb538d5d19/html5/thumbnails/6.jpg)
![Page 7: Microservices - · PDF file(stateless) user_db Microservices have their own data store “Let the need-to-know principle ... • Authentication • Authorisation • Logging & Auditing](https://reader033.vdocuments.us/reader033/viewer/2022051718/5a723b437f8b9abb538d5d19/html5/thumbnails/7.jpg)
Microservices (2016) …
small, hence many services
talking over the network built with different technologies
by autonomous teams with end-to-end responsibility doing DevOps and Continuous Delivery
using containers
![Page 8: Microservices - · PDF file(stateless) user_db Microservices have their own data store “Let the need-to-know principle ... • Authentication • Authorisation • Logging & Auditing](https://reader033.vdocuments.us/reader033/viewer/2022051718/5a723b437f8b9abb538d5d19/html5/thumbnails/8.jpg)
Microservices (2016) …
small, hence many services
talking over the network built with different technologies
by autonomous teams with end-to-end responsibility doing DevOps and Continuous Delivery
using containers
![Page 9: Microservices - · PDF file(stateless) user_db Microservices have their own data store “Let the need-to-know principle ... • Authentication • Authorisation • Logging & Auditing](https://reader033.vdocuments.us/reader033/viewer/2022051718/5a723b437f8b9abb538d5d19/html5/thumbnails/9.jpg)
Microservices are the result of combining
architectural ideas from lightweight SOA and Domain Driven Design,
organisational approaches like DevOps and Agile Software Development, and
technology innovations like Containers and Programmable Infrastructure
![Page 10: Microservices - · PDF file(stateless) user_db Microservices have their own data store “Let the need-to-know principle ... • Authentication • Authorisation • Logging & Auditing](https://reader033.vdocuments.us/reader033/viewer/2022051718/5a723b437f8b9abb538d5d19/html5/thumbnails/10.jpg)
Architecture Organisation
Technology
![Page 11: Microservices - · PDF file(stateless) user_db Microservices have their own data store “Let the need-to-know principle ... • Authentication • Authorisation • Logging & Auditing](https://reader033.vdocuments.us/reader033/viewer/2022051718/5a723b437f8b9abb538d5d19/html5/thumbnails/11.jpg)
Monolith
![Page 12: Microservices - · PDF file(stateless) user_db Microservices have their own data store “Let the need-to-know principle ... • Authentication • Authorisation • Logging & Auditing](https://reader033.vdocuments.us/reader033/viewer/2022051718/5a723b437f8b9abb538d5d19/html5/thumbnails/12.jpg)
“many small services”
![Page 13: Microservices - · PDF file(stateless) user_db Microservices have their own data store “Let the need-to-know principle ... • Authentication • Authorisation • Logging & Auditing](https://reader033.vdocuments.us/reader033/viewer/2022051718/5a723b437f8b9abb538d5d19/html5/thumbnails/13.jpg)
Monolith - method calls
![Page 14: Microservices - · PDF file(stateless) user_db Microservices have their own data store “Let the need-to-know principle ... • Authentication • Authorisation • Logging & Auditing](https://reader033.vdocuments.us/reader033/viewer/2022051718/5a723b437f8b9abb538d5d19/html5/thumbnails/14.jpg)
Microservices - talking over the network
![Page 15: Microservices - · PDF file(stateless) user_db Microservices have their own data store “Let the need-to-know principle ... • Authentication • Authorisation • Logging & Auditing](https://reader033.vdocuments.us/reader033/viewer/2022051718/5a723b437f8b9abb538d5d19/html5/thumbnails/15.jpg)
Java7(1.7.0_03)
Monolith - few technologies
![Page 16: Microservices - · PDF file(stateless) user_db Microservices have their own data store “Let the need-to-know principle ... • Authentication • Authorisation • Logging & Auditing](https://reader033.vdocuments.us/reader033/viewer/2022051718/5a723b437f8b9abb538d5d19/html5/thumbnails/16.jpg)
Microservices - built with different technologies
nodejs0.9
Ruby2.1
Java7
Go1.4
Java8
![Page 17: Microservices - · PDF file(stateless) user_db Microservices have their own data store “Let the need-to-know principle ... • Authentication • Authorisation • Logging & Auditing](https://reader033.vdocuments.us/reader033/viewer/2022051718/5a723b437f8b9abb538d5d19/html5/thumbnails/17.jpg)
Security Gates vs…
![Page 18: Microservices - · PDF file(stateless) user_db Microservices have their own data store “Let the need-to-know principle ... • Authentication • Authorisation • Logging & Auditing](https://reader033.vdocuments.us/reader033/viewer/2022051718/5a723b437f8b9abb538d5d19/html5/thumbnails/18.jpg)
… autonomous teams with end-to-end responsibility
![Page 19: Microservices - · PDF file(stateless) user_db Microservices have their own data store “Let the need-to-know principle ... • Authentication • Authorisation • Logging & Auditing](https://reader033.vdocuments.us/reader033/viewer/2022051718/5a723b437f8b9abb538d5d19/html5/thumbnails/19.jpg)
dedicated security experts vs…
(ISC)2®
![Page 20: Microservices - · PDF file(stateless) user_db Microservices have their own data store “Let the need-to-know principle ... • Authentication • Authorisation • Logging & Auditing](https://reader033.vdocuments.us/reader033/viewer/2022051718/5a723b437f8b9abb538d5d19/html5/thumbnails/20.jpg)
doing DevOps
OWASP??
![Page 21: Microservices - · PDF file(stateless) user_db Microservices have their own data store “Let the need-to-know principle ... • Authentication • Authorisation • Logging & Auditing](https://reader033.vdocuments.us/reader033/viewer/2022051718/5a723b437f8b9abb538d5d19/html5/thumbnails/21.jpg)
classic “Security Sandwich” vs…
Specification
Implementation Validation
![Page 22: Microservices - · PDF file(stateless) user_db Microservices have their own data store “Let the need-to-know principle ... • Authentication • Authorisation • Logging & Auditing](https://reader033.vdocuments.us/reader033/viewer/2022051718/5a723b437f8b9abb538d5d19/html5/thumbnails/22.jpg)
… Continuous Delivery
![Page 23: Microservices - · PDF file(stateless) user_db Microservices have their own data store “Let the need-to-know principle ... • Authentication • Authorisation • Logging & Auditing](https://reader033.vdocuments.us/reader033/viewer/2022051718/5a723b437f8b9abb538d5d19/html5/thumbnails/23.jpg)
well isolated “real server” vs…
![Page 24: Microservices - · PDF file(stateless) user_db Microservices have their own data store “Let the need-to-know principle ... • Authentication • Authorisation • Logging & Auditing](https://reader033.vdocuments.us/reader033/viewer/2022051718/5a723b437f8b9abb538d5d19/html5/thumbnails/24.jpg)
… using containers
![Page 25: Microservices - · PDF file(stateless) user_db Microservices have their own data store “Let the need-to-know principle ... • Authentication • Authorisation • Logging & Auditing](https://reader033.vdocuments.us/reader033/viewer/2022051718/5a723b437f8b9abb538d5d19/html5/thumbnails/25.jpg)
Attack surface - VMs vs containers
XENHypervisor-10^5LOC
LinuxKernel-10^7LOC
![Page 26: Microservices - · PDF file(stateless) user_db Microservices have their own data store “Let the need-to-know principle ... • Authentication • Authorisation • Logging & Auditing](https://reader033.vdocuments.us/reader033/viewer/2022051718/5a723b437f8b9abb538d5d19/html5/thumbnails/26.jpg)
![Page 27: Microservices - · PDF file(stateless) user_db Microservices have their own data store “Let the need-to-know principle ... • Authentication • Authorisation • Logging & Auditing](https://reader033.vdocuments.us/reader033/viewer/2022051718/5a723b437f8b9abb538d5d19/html5/thumbnails/27.jpg)
![Page 28: Microservices - · PDF file(stateless) user_db Microservices have their own data store “Let the need-to-know principle ... • Authentication • Authorisation • Logging & Auditing](https://reader033.vdocuments.us/reader033/viewer/2022051718/5a723b437f8b9abb538d5d19/html5/thumbnails/28.jpg)
Highly coupled services No clear boundaries
![Page 29: Microservices - · PDF file(stateless) user_db Microservices have their own data store “Let the need-to-know principle ... • Authentication • Authorisation • Logging & Auditing](https://reader033.vdocuments.us/reader033/viewer/2022051718/5a723b437f8b9abb538d5d19/html5/thumbnails/29.jpg)
Loosely coupled services Clear boundaries
![Page 30: Microservices - · PDF file(stateless) user_db Microservices have their own data store “Let the need-to-know principle ... • Authentication • Authorisation • Logging & Auditing](https://reader033.vdocuments.us/reader033/viewer/2022051718/5a723b437f8b9abb538d5d19/html5/thumbnails/30.jpg)
many small services
![Page 31: Microservices - · PDF file(stateless) user_db Microservices have their own data store “Let the need-to-know principle ... • Authentication • Authorisation • Logging & Auditing](https://reader033.vdocuments.us/reader033/viewer/2022051718/5a723b437f8b9abb538d5d19/html5/thumbnails/31.jpg)
impact of breach can be contained locally
![Page 32: Microservices - · PDF file(stateless) user_db Microservices have their own data store “Let the need-to-know principle ... • Authentication • Authorisation • Logging & Auditing](https://reader033.vdocuments.us/reader033/viewer/2022051718/5a723b437f8b9abb538d5d19/html5/thumbnails/32.jpg)
“Clear service boundaries limit the impact of breaches”
![Page 33: Microservices - · PDF file(stateless) user_db Microservices have their own data store “Let the need-to-know principle ... • Authentication • Authorisation • Logging & Auditing](https://reader033.vdocuments.us/reader033/viewer/2022051718/5a723b437f8b9abb538d5d19/html5/thumbnails/33.jpg)
Keep APIs minimal
![Page 34: Microservices - · PDF file(stateless) user_db Microservices have their own data store “Let the need-to-know principle ... • Authentication • Authorisation • Logging & Auditing](https://reader033.vdocuments.us/reader033/viewer/2022051718/5a723b437f8b9abb538d5d19/html5/thumbnails/34.jpg)
payment_data
(stateless)
cat_ pictures
(stateless)
user_db
Microservices have their own data store
![Page 35: Microservices - · PDF file(stateless) user_db Microservices have their own data store “Let the need-to-know principle ... • Authentication • Authorisation • Logging & Auditing](https://reader033.vdocuments.us/reader033/viewer/2022051718/5a723b437f8b9abb538d5d19/html5/thumbnails/35.jpg)
payment_data
(stateless)
cat_ pictures
(stateless)
user_db
Microservices have their own data store
![Page 36: Microservices - · PDF file(stateless) user_db Microservices have their own data store “Let the need-to-know principle ... • Authentication • Authorisation • Logging & Auditing](https://reader033.vdocuments.us/reader033/viewer/2022051718/5a723b437f8b9abb538d5d19/html5/thumbnails/36.jpg)
“Let the need-to-know principle guide your API design”
![Page 37: Microservices - · PDF file(stateless) user_db Microservices have their own data store “Let the need-to-know principle ... • Authentication • Authorisation • Logging & Auditing](https://reader033.vdocuments.us/reader033/viewer/2022051718/5a723b437f8b9abb538d5d19/html5/thumbnails/37.jpg)
payment_data
(stateless)
cat_ pictures
(stateless)
user_db
different security levels should require different security properties in services, e.g. encryption, auth, security testing…
![Page 38: Microservices - · PDF file(stateless) user_db Microservices have their own data store “Let the need-to-know principle ... • Authentication • Authorisation • Logging & Auditing](https://reader033.vdocuments.us/reader033/viewer/2022051718/5a723b437f8b9abb538d5d19/html5/thumbnails/38.jpg)
“Classify services into distinct security levels”
![Page 39: Microservices - · PDF file(stateless) user_db Microservices have their own data store “Let the need-to-know principle ... • Authentication • Authorisation • Logging & Auditing](https://reader033.vdocuments.us/reader033/viewer/2022051718/5a723b437f8b9abb538d5d19/html5/thumbnails/39.jpg)
API Gateways
APIG
atew
ay
• Access control • Rate limiting • HTTPS termination
. . .
![Page 40: Microservices - · PDF file(stateless) user_db Microservices have their own data store “Let the need-to-know principle ... • Authentication • Authorisation • Logging & Auditing](https://reader033.vdocuments.us/reader033/viewer/2022051718/5a723b437f8b9abb538d5d19/html5/thumbnails/40.jpg)
API Gateways
APIG
atew
ay
WAF PaymentSvc.
![Page 41: Microservices - · PDF file(stateless) user_db Microservices have their own data store “Let the need-to-know principle ... • Authentication • Authorisation • Logging & Auditing](https://reader033.vdocuments.us/reader033/viewer/2022051718/5a723b437f8b9abb538d5d19/html5/thumbnails/41.jpg)
“Isolate services with different security levels through gateways”
![Page 42: Microservices - · PDF file(stateless) user_db Microservices have their own data store “Let the need-to-know principle ... • Authentication • Authorisation • Logging & Auditing](https://reader033.vdocuments.us/reader033/viewer/2022051718/5a723b437f8b9abb538d5d19/html5/thumbnails/42.jpg)
Authorization & Authentication
![Page 43: Microservices - · PDF file(stateless) user_db Microservices have their own data store “Let the need-to-know principle ... • Authentication • Authorisation • Logging & Auditing](https://reader033.vdocuments.us/reader033/viewer/2022051718/5a723b437f8b9abb538d5d19/html5/thumbnails/43.jpg)
Authorization & Authentication
![Page 44: Microservices - · PDF file(stateless) user_db Microservices have their own data store “Let the need-to-know principle ... • Authentication • Authorisation • Logging & Auditing](https://reader033.vdocuments.us/reader033/viewer/2022051718/5a723b437f8b9abb538d5d19/html5/thumbnails/44.jpg)
“Use scalable auth techniques without single points of failure”
![Page 45: Microservices - · PDF file(stateless) user_db Microservices have their own data store “Let the need-to-know principle ... • Authentication • Authorisation • Logging & Auditing](https://reader033.vdocuments.us/reader033/viewer/2022051718/5a723b437f8b9abb538d5d19/html5/thumbnails/45.jpg)
![Page 46: Microservices - · PDF file(stateless) user_db Microservices have their own data store “Let the need-to-know principle ... • Authentication • Authorisation • Logging & Auditing](https://reader033.vdocuments.us/reader033/viewer/2022051718/5a723b437f8b9abb538d5d19/html5/thumbnails/46.jpg)
Secrets management
vaultproject.io square.github.io/keywhiz
![Page 47: Microservices - · PDF file(stateless) user_db Microservices have their own data store “Let the need-to-know principle ... • Authentication • Authorisation • Logging & Auditing](https://reader033.vdocuments.us/reader033/viewer/2022051718/5a723b437f8b9abb538d5d19/html5/thumbnails/47.jpg)
“Manage secrets with special purpose services”
![Page 48: Microservices - · PDF file(stateless) user_db Microservices have their own data store “Let the need-to-know principle ... • Authentication • Authorisation • Logging & Auditing](https://reader033.vdocuments.us/reader033/viewer/2022051718/5a723b437f8b9abb538d5d19/html5/thumbnails/48.jpg)
![Page 49: Microservices - · PDF file(stateless) user_db Microservices have their own data store “Let the need-to-know principle ... • Authentication • Authorisation • Logging & Auditing](https://reader033.vdocuments.us/reader033/viewer/2022051718/5a723b437f8b9abb538d5d19/html5/thumbnails/49.jpg)
Freeze image for analysis
paymentservice
instance#2
docsuploadservice
instance#1
paymentservice
instance#1
catpictureservice
instance#1
memegeneratorinstance#1
bookmarkmanager
instance#1
paymentservice
instance#1
![Page 50: Microservices - · PDF file(stateless) user_db Microservices have their own data store “Let the need-to-know principle ... • Authentication • Authorisation • Logging & Auditing](https://reader033.vdocuments.us/reader033/viewer/2022051718/5a723b437f8b9abb538d5d19/html5/thumbnails/50.jpg)
Or even the running container… (criu.org)
paymentservice
instance#2
docsuploadservice
instance#1
paymentservice
instance#1
catpictureservice
instance#1
memegeneratorinstance#1
bookmarkmanager
instance#1
paymentservice
instance#1
![Page 51: Microservices - · PDF file(stateless) user_db Microservices have their own data store “Let the need-to-know principle ... • Authentication • Authorisation • Logging & Auditing](https://reader033.vdocuments.us/reader033/viewer/2022051718/5a723b437f8b9abb538d5d19/html5/thumbnails/51.jpg)
“Leverage container features for forensics”
![Page 52: Microservices - · PDF file(stateless) user_db Microservices have their own data store “Let the need-to-know principle ... • Authentication • Authorisation • Logging & Auditing](https://reader033.vdocuments.us/reader033/viewer/2022051718/5a723b437f8b9abb538d5d19/html5/thumbnails/52.jpg)
Scheduling constraints
paymentservice
instance#2
docsuploadservice
instance#1
paymentservice
instance#1
catpictureservice
instance#1
memegeneratorinstance#1
bookmarkmanager
instance#1
![Page 53: Microservices - · PDF file(stateless) user_db Microservices have their own data store “Let the need-to-know principle ... • Authentication • Authorisation • Logging & Auditing](https://reader033.vdocuments.us/reader033/viewer/2022051718/5a723b437f8b9abb538d5d19/html5/thumbnails/53.jpg)
“Run services of different security levels on different hosts”
![Page 54: Microservices - · PDF file(stateless) user_db Microservices have their own data store “Let the need-to-know principle ... • Authentication • Authorisation • Logging & Auditing](https://reader033.vdocuments.us/reader033/viewer/2022051718/5a723b437f8b9abb538d5d19/html5/thumbnails/54.jpg)
Replace containers on deploy
paymentservice
instance#2
docsuploadservice
instance#1
paymentservice
instance#3
catpictureservice
instance#1
memegeneratorinstance#1
bookmarkmanager
instance#1
![Page 55: Microservices - · PDF file(stateless) user_db Microservices have their own data store “Let the need-to-know principle ... • Authentication • Authorisation • Logging & Auditing](https://reader033.vdocuments.us/reader033/viewer/2022051718/5a723b437f8b9abb538d5d19/html5/thumbnails/55.jpg)
“Embrace immutable infrastructure”
![Page 56: Microservices - · PDF file(stateless) user_db Microservices have their own data store “Let the need-to-know principle ... • Authentication • Authorisation • Logging & Auditing](https://reader033.vdocuments.us/reader033/viewer/2022051718/5a723b437f8b9abb538d5d19/html5/thumbnails/56.jpg)
“built with different technologies”
nodejs0.9
Ruby2.1
Java7
Go1.4
Java8
![Page 57: Microservices - · PDF file(stateless) user_db Microservices have their own data store “Let the need-to-know principle ... • Authentication • Authorisation • Logging & Auditing](https://reader033.vdocuments.us/reader033/viewer/2022051718/5a723b437f8b9abb538d5d19/html5/thumbnails/57.jpg)
Monocultures…
![Page 58: Microservices - · PDF file(stateless) user_db Microservices have their own data store “Let the need-to-know principle ... • Authentication • Authorisation • Logging & Auditing](https://reader033.vdocuments.us/reader033/viewer/2022051718/5a723b437f8b9abb538d5d19/html5/thumbnails/58.jpg)
Scanning images at rest
Clair(CoreOS)Nautilus(DockerInc.)
![Page 59: Microservices - · PDF file(stateless) user_db Microservices have their own data store “Let the need-to-know principle ... • Authentication • Authorisation • Logging & Auditing](https://reader033.vdocuments.us/reader033/viewer/2022051718/5a723b437f8b9abb538d5d19/html5/thumbnails/59.jpg)
“Scan images already during the build process”
![Page 60: Microservices - · PDF file(stateless) user_db Microservices have their own data store “Let the need-to-know principle ... • Authentication • Authorisation • Logging & Auditing](https://reader033.vdocuments.us/reader033/viewer/2022051718/5a723b437f8b9abb538d5d19/html5/thumbnails/60.jpg)
Container technology…
BSDJails2000
2001Virtuozzo
Linux-VServer
SolarisZones2004
LXC2008
2013Docker
rkt2014
1982chroot
2007cgroups
![Page 61: Microservices - · PDF file(stateless) user_db Microservices have their own data store “Let the need-to-know principle ... • Authentication • Authorisation • Logging & Auditing](https://reader033.vdocuments.us/reader033/viewer/2022051718/5a723b437f8b9abb538d5d19/html5/thumbnails/61.jpg)
Docker security hardening…
container-solutions.com/security
•read-onlycontainers•minimalbaseimages•dropcapabilities•traditionalhardening(AppArmor,SELinux…)
...
![Page 62: Microservices - · PDF file(stateless) user_db Microservices have their own data store “Let the need-to-know principle ... • Authentication • Authorisation • Logging & Auditing](https://reader033.vdocuments.us/reader033/viewer/2022051718/5a723b437f8b9abb538d5d19/html5/thumbnails/62.jpg)
“Minimise the attack surface of images and hosts”
![Page 63: Microservices - · PDF file(stateless) user_db Microservices have their own data store “Let the need-to-know principle ... • Authentication • Authorisation • Logging & Auditing](https://reader033.vdocuments.us/reader033/viewer/2022051718/5a723b437f8b9abb538d5d19/html5/thumbnails/63.jpg)
Unify & secure deployment methods
Simple to add… • TLS • Authentication • Authorisation • Logging & Auditing • Image verification
scprsync
git
![Page 64: Microservices - · PDF file(stateless) user_db Microservices have their own data store “Let the need-to-know principle ... • Authentication • Authorisation • Logging & Auditing](https://reader033.vdocuments.us/reader033/viewer/2022051718/5a723b437f8b9abb538d5d19/html5/thumbnails/64.jpg)
“Have a single, hardened method to deploy”
![Page 65: Microservices - · PDF file(stateless) user_db Microservices have their own data store “Let the need-to-know principle ... • Authentication • Authorisation • Logging & Auditing](https://reader033.vdocuments.us/reader033/viewer/2022051718/5a723b437f8b9abb538d5d19/html5/thumbnails/65.jpg)
![Page 66: Microservices - · PDF file(stateless) user_db Microservices have their own data store “Let the need-to-know principle ... • Authentication • Authorisation • Logging & Auditing](https://reader033.vdocuments.us/reader033/viewer/2022051718/5a723b437f8b9abb538d5d19/html5/thumbnails/66.jpg)
…end-to-end responsibility
![Page 67: Microservices - · PDF file(stateless) user_db Microservices have their own data store “Let the need-to-know principle ... • Authentication • Authorisation • Logging & Auditing](https://reader033.vdocuments.us/reader033/viewer/2022051718/5a723b437f8b9abb538d5d19/html5/thumbnails/67.jpg)
Gates and Accountability
![Page 68: Microservices - · PDF file(stateless) user_db Microservices have their own data store “Let the need-to-know principle ... • Authentication • Authorisation • Logging & Auditing](https://reader033.vdocuments.us/reader033/viewer/2022051718/5a723b437f8b9abb538d5d19/html5/thumbnails/68.jpg)
Security Sandwich and Autonomy
Specification
Implementation Validation
![Page 69: Microservices - · PDF file(stateless) user_db Microservices have their own data store “Let the need-to-know principle ... • Authentication • Authorisation • Logging & Auditing](https://reader033.vdocuments.us/reader033/viewer/2022051718/5a723b437f8b9abb538d5d19/html5/thumbnails/69.jpg)
Security Sandwich and Autonomy
![Page 70: Microservices - · PDF file(stateless) user_db Microservices have their own data store “Let the need-to-know principle ... • Authentication • Authorisation • Logging & Auditing](https://reader033.vdocuments.us/reader033/viewer/2022051718/5a723b437f8b9abb538d5d19/html5/thumbnails/70.jpg)
Trust
IdeafromA.T.KearnyAnalysis
Accountability Expertise
Autonomy&Entrepreneurship
Collaboration&Support
Trust
![Page 71: Microservices - · PDF file(stateless) user_db Microservices have their own data store “Let the need-to-know principle ... • Authentication • Authorisation • Logging & Auditing](https://reader033.vdocuments.us/reader033/viewer/2022051718/5a723b437f8b9abb538d5d19/html5/thumbnails/71.jpg)
Security aspects must becomepart of the Definition of Done…
![Page 73: Microservices - · PDF file(stateless) user_db Microservices have their own data store “Let the need-to-know principle ... • Authentication • Authorisation • Logging & Auditing](https://reader033.vdocuments.us/reader033/viewer/2022051718/5a723b437f8b9abb538d5d19/html5/thumbnails/73.jpg)
SecDevOps?
SecOps?
DevSec?
![Page 74: Microservices - · PDF file(stateless) user_db Microservices have their own data store “Let the need-to-know principle ... • Authentication • Authorisation • Logging & Auditing](https://reader033.vdocuments.us/reader033/viewer/2022051718/5a723b437f8b9abb538d5d19/html5/thumbnails/74.jpg)
![Page 75: Microservices - · PDF file(stateless) user_db Microservices have their own data store “Let the need-to-know principle ... • Authentication • Authorisation • Logging & Auditing](https://reader033.vdocuments.us/reader033/viewer/2022051718/5a723b437f8b9abb538d5d19/html5/thumbnails/75.jpg)
TheroleofITArchitectsisalreadychanging
Now,theroleoftheSecurityTeamneedstochange
![Page 76: Microservices - · PDF file(stateless) user_db Microservices have their own data store “Let the need-to-know principle ... • Authentication • Authorisation • Logging & Auditing](https://reader033.vdocuments.us/reader033/viewer/2022051718/5a723b437f8b9abb538d5d19/html5/thumbnails/76.jpg)
“Accountability ensures security is built in, not bolted on”
![Page 77: Microservices - · PDF file(stateless) user_db Microservices have their own data store “Let the need-to-know principle ... • Authentication • Authorisation • Logging & Auditing](https://reader033.vdocuments.us/reader033/viewer/2022051718/5a723b437f8b9abb538d5d19/html5/thumbnails/77.jpg)
Avg: 103 days to fix a vulnerability
http://darkmatters.norsecorp.com/2015/06/09/security-vulnerabilities-take-average-of-103-days-to-remediate/
![Page 78: Microservices - · PDF file(stateless) user_db Microservices have their own data store “Let the need-to-know principle ... • Authentication • Authorisation • Logging & Auditing](https://reader033.vdocuments.us/reader033/viewer/2022051718/5a723b437f8b9abb538d5d19/html5/thumbnails/78.jpg)
CD reduces reaction time
![Page 79: Microservices - · PDF file(stateless) user_db Microservices have their own data store “Let the need-to-know principle ... • Authentication • Authorisation • Logging & Auditing](https://reader033.vdocuments.us/reader033/viewer/2022051718/5a723b437f8b9abb538d5d19/html5/thumbnails/79.jpg)
“Leverage Continuous Delivery as a security feature”
![Page 80: Microservices - · PDF file(stateless) user_db Microservices have their own data store “Let the need-to-know principle ... • Authentication • Authorisation • Logging & Auditing](https://reader033.vdocuments.us/reader033/viewer/2022051718/5a723b437f8b9abb538d5d19/html5/thumbnails/80.jpg)
Test pyramid
UnitTests
ServiceTests
UItests
fasterfeed
back
from“SucceedingwithAgile”(MikeCohn)
confiden
ce
![Page 81: Microservices - · PDF file(stateless) user_db Microservices have their own data store “Let the need-to-know principle ... • Authentication • Authorisation • Logging & Auditing](https://reader033.vdocuments.us/reader033/viewer/2022051718/5a723b437f8b9abb538d5d19/html5/thumbnails/81.jpg)
Security-Test pyramid / AppSec pipeline
staticcodeanalysis
Vulnerabilityscanning
E2Esecuritytests
fasterfeed
back
confiden
ce
![Page 82: Microservices - · PDF file(stateless) user_db Microservices have their own data store “Let the need-to-know principle ... • Authentication • Authorisation • Logging & Auditing](https://reader033.vdocuments.us/reader033/viewer/2022051718/5a723b437f8b9abb538d5d19/html5/thumbnails/82.jpg)
BDD style
continuumsecurity.net/bdd-intro.htmlgauntlt.org
![Page 83: Microservices - · PDF file(stateless) user_db Microservices have their own data store “Let the need-to-know principle ... • Authentication • Authorisation • Logging & Auditing](https://reader033.vdocuments.us/reader033/viewer/2022051718/5a723b437f8b9abb538d5d19/html5/thumbnails/83.jpg)
“Have your test pyramid reflect security”
![Page 84: Microservices - · PDF file(stateless) user_db Microservices have their own data store “Let the need-to-know principle ... • Authentication • Authorisation • Logging & Auditing](https://reader033.vdocuments.us/reader033/viewer/2022051718/5a723b437f8b9abb538d5d19/html5/thumbnails/84.jpg)
Architecture Organisation
Technology
![Page 85: Microservices - · PDF file(stateless) user_db Microservices have their own data store “Let the need-to-know principle ... • Authentication • Authorisation • Logging & Auditing](https://reader033.vdocuments.us/reader033/viewer/2022051718/5a723b437f8b9abb538d5d19/html5/thumbnails/85.jpg)
Architecture
Clearserviceboundarieslimittheimpactofbreaches
Lettheneed-to-knowprincipleguideyourAPIdesign
Classifyservicesintodistinctsecuritylevels,whichmandatedifferentsecurityproperties
Usescalableauthtechniqueswithoutsinglepointsoffailure
Isolateserviceswithdifferentsecuritylevelswithgateways
Managesecretsinspecialisedservices
![Page 86: Microservices - · PDF file(stateless) user_db Microservices have their own data store “Let the need-to-know principle ... • Authentication • Authorisation • Logging & Auditing](https://reader033.vdocuments.us/reader033/viewer/2022051718/5a723b437f8b9abb538d5d19/html5/thumbnails/86.jpg)
Technology
Runservicesofdifferentsecuritylevelsondifferenthosts
Leveragecontainerfeaturesforforensics
Embraceimmutableinfrastructure
Scanimagesaspartofthebuildprocess
Haveasingle,hardenedmethodtodeploy
Minimisetheattacksurfaceofimagesandhosts
![Page 87: Microservices - · PDF file(stateless) user_db Microservices have their own data store “Let the need-to-know principle ... • Authentication • Authorisation • Logging & Auditing](https://reader033.vdocuments.us/reader033/viewer/2022051718/5a723b437f8b9abb538d5d19/html5/thumbnails/87.jpg)
Organisation
LeverageContinuousDeliveryasasecurityfeature
Haveyourtestpyramidreflectsecurity
Accountabilityensuressecurityisbuiltin,notboltedon
![Page 88: Microservices - · PDF file(stateless) user_db Microservices have their own data store “Let the need-to-know principle ... • Authentication • Authorisation • Logging & Auditing](https://reader033.vdocuments.us/reader033/viewer/2022051718/5a723b437f8b9abb538d5d19/html5/thumbnails/88.jpg)
Nightmare?