APPSEC AND MICROSERVICES Sam Newman GOTO Copenhagen 2016 @gotocph - - PowerPoint PPT Presentation

▶
appsec and microservices
SMART_READER_LITE
LIVE PREVIEW

APPSEC AND MICROSERVICES Sam Newman GOTO Copenhagen 2016 @gotocph - - PowerPoint PPT Presentation

Sep 01, 2022 260 likes •1.25k views

APPSEC AND MICROSERVICES Sam Newman GOTO Copenhagen 2016 @gotocph @samnewman @gotocph @samnewman https://www. fl ickr.com/photos/seattlemunicipalarchives/4058808950 @gotocph @samnewman https://www. fl

slide-1
SLIDE 1
slide-2
SLIDE 2

APPSEC AND MICROSERVICES

Sam Newman GOTO Copenhagen 2016

slide-3
SLIDE 3

@samnewman @gotocph

slide-4
SLIDE 4

@samnewman @gotocph

https://www.flickr.com/photos/seattlemunicipalarchives/4058808950

slide-5
SLIDE 5

@samnewman @gotocph

https://www.flickr.com/photos/theseanster93/485390997/

slide-6
SLIDE 6

@samnewman @gotocph

http://map.norsecorp.com/

slide-7
SLIDE 7

@samnewman @gotocph

slide-8
SLIDE 8

@samnewman @gotocph

slide-9
SLIDE 9

@samnewman @gotocph

Accounts Returns Invoicing Shipping Inventory Customer Service

slide-10
SLIDE 10

@samnewman @gotocph

Accounts Returns Invoicing Shipping Inventory Customer Service

Small Autonomous services that work together, modelled around a business domain

slide-11
SLIDE 11

https://www.flickr.com/photos/wwworks/2607036664/

slide-12
SLIDE 12

https://www.flickr.com/photos/lkowen/15803718243/

slide-13
SLIDE 13

@samnewman @gotocph

slide-14
SLIDE 14

@samnewman @gotocph

slide-15
SLIDE 15

@samnewman @gotocph

slide-16
SLIDE 16

@samnewman @gotocph

slide-17
SLIDE 17

@samnewman @gotocph

slide-18
SLIDE 18

@samnewman @gotocph

Prevention

slide-19
SLIDE 19

@samnewman @gotocph

Prevention Detection

slide-20
SLIDE 20

@samnewman @gotocph

Prevention Detection Response

slide-21
SLIDE 21

@samnewman @gotocph

Prevention Detection Response Recovery

slide-22
SLIDE 22

@samnewman @gotocph

Prevention Detection Response Recovery

slide-23
SLIDE 23

@samnewman @gotocph

Prevention Detection Response Recovery

slide-24
SLIDE 24

@samnewman @gotocph

https://www.flickr.com/photos/adulau/15680439035/

slide-25
SLIDE 25

@samnewman @gotocph

https://www.flickr.com/photos/duanestorey/469163789/

slide-26
SLIDE 26

@samnewman @gotocph

https://www.schneier.com/paper-attacktrees-ddj-ft.html

slide-27
SLIDE 27

@samnewman @gotocph

Open Safe

slide-28
SLIDE 28

@samnewman @gotocph

Open Safe Pick Lock Learn Combo Cut Open

slide-29
SLIDE 29

@samnewman @gotocph

Open Safe Pick Lock Learn Combo Cut Open Find Written Combo Get Combo from the target

slide-30
SLIDE 30

@samnewman @gotocph

Open Safe Pick Lock Learn Combo Cut Open Find Written Combo Get Combo from the target Blackmail Threaten Bribe

slide-31
SLIDE 31

@samnewman @gotocph

Open Safe Pick Lock Learn Combo Cut Open Find Written Combo Get Combo from the target Blackmail Threaten Bribe

Impossible Impossible Impossible Possible Possible Possible

slide-32
SLIDE 32

@samnewman @gotocph

Catalog service Music Web Shop Recommend service Royalty Payment Gateway Mobile app Web browsers User service

slide-33
SLIDE 33

@samnewman @gotocph

Catalog service Music Web Shop Recommend service Royalty Payment Gateway Mobile app Web browsers User service

Transport Security

slide-34
SLIDE 34

@samnewman @gotocph

HTTPS Everywhere!

slide-35
SLIDE 35

BENEFITS OF HTTPS?

slide-36
SLIDE 36

BENEFITS OF HTTPS?

▫︎ Server guarantees!

slide-37
SLIDE 37

BENEFITS OF HTTPS?

▫︎ Server guarantees! ▫︎ Payload not manipulated…

slide-38
SLIDE 38

BENEFITS OF HTTPS?

▫︎ Server guarantees! ▫︎ Payload not manipulated… ▫︎ …but no client guarantee and…

slide-39
SLIDE 39

BENEFITS OF HTTPS?

▫︎ Server guarantees! ▫︎ Payload not manipulated… ▫︎ …but no client guarantee and… ▫︎ …certificates can be a pain

slide-40
SLIDE 40

@samnewman @gotocph

https://letsencrypt.org/

slide-41
SLIDE 41

@samnewman @gotocph

slide-42
SLIDE 42

Catalog service Music Web Shop Recommend service Royalty Payment Gateway Mobile app Web browsers User service

slide-43
SLIDE 43

CLIENT-SIDE CERTIFICATES?

slide-44
SLIDE 44

CLIENT-SIDE CERTIFICATES?

▫︎ Client guarantees!

slide-45
SLIDE 45

CLIENT-SIDE CERTIFICATES?

▫︎ Client guarantees! ▫︎ …but a PITA to manage….

slide-46
SLIDE 46

@samnewman @gotocph

http://techblog.netflix.com/2015/09/introducing-lemur.html

slide-47
SLIDE 47

@samnewman @gotocph

Catalog service Music Web Shop Recommend service Royalty Payment Gateway Mobile app Web browsers User service

slide-48
SLIDE 48

@samnewman @gotocph

Auth?

slide-49
SLIDE 49

@samnewman @gotocph

Catalog service Music Web Shop Recommend service Royalty Payment Gateway Mobile app Web browsers User service Web browsers

Form Auth OAuth

slide-50
SLIDE 50

@samnewman @gotocph

Catalog service Music Web Shop Recommend service Royalty Payment Gateway Mobile app Web browsers User service Web browsers

Form Auth OAuth

User service

slide-51
SLIDE 51

@samnewman @gotocph

Catalog service Music Web Shop Recommend service Royalty Payment Gateway Mobile app Web browsers User service Web browsers

Form Auth OAuth

User service

slide-52
SLIDE 52

@samnewman @gotocph

Confused Deputy Problem!

slide-53
SLIDE 53

@samnewman @gotocph

Data At Rest?

slide-54
SLIDE 54

@samnewman @gotocph

Catalog service Music Web Shop Recommend service Royalty Payment Gateway Mobile app Web browsers User service User service

slide-55
SLIDE 55

@samnewman @gotocph

Aside: Docker

slide-56
SLIDE 56

@samnewman @gotocph

http://www.banyanops.com/blog/analyzing-docker-hub/

slide-57
SLIDE 57

@samnewman @gotocph

S/M Tests Build Large Tests Production Security? Security?

slide-58
SLIDE 58

@samnewman @gotocph

S/M Tests Build Large Tests Production Security? Security?

slide-59
SLIDE 59

@samnewman @gotocph

https://www.microsoft.com/en-us/sdl/

slide-60
SLIDE 60

@samnewman @gotocph

Patch Your Stuff

slide-61
SLIDE 61

@samnewman @gotocph

Prevention Detection Response Recovery

slide-62
SLIDE 62

@samnewman @gotocph

Prevention Detection Response Recovery

slide-63
SLIDE 63

@samnewman @gotocph

https://www.qualys.com/research/top10/

slide-64
SLIDE 64

@samnewman @gotocph

http://www.extremetech.com/computing/190959-shellshock-a-deadly-new-vulnerability-that-could-lay-waste-to-the-internet

slide-65
SLIDE 65

@samnewman @gotocph

slide-66
SLIDE 66

@samnewman @gotocph

https://www.modsecurity.org/

slide-67
SLIDE 67

@samnewman @gotocph

Catalog service Music Web Shop Recommend service Royalty service Mobile app Web browsers User service

slide-68
SLIDE 68

@samnewman @gotocph

Catalog service Music Web Shop Recommend service Royalty service Mobile app Web browsers User service

PERIMETER SECURITY!

slide-69
SLIDE 69

@samnewman @gotocph

Polyglot = more stuff to track!

slide-70
SLIDE 70

@samnewman @gotocph

Polyglot = more things to break?

slide-71
SLIDE 71

@samnewman @gotocph

Prevention Detection Response Recovery

slide-72
SLIDE 72

@samnewman @gotocph

Prevention Detection Response Recovery

slide-73
SLIDE 73

@samnewman @gotocph

slide-74
SLIDE 74

@samnewman @gotocph

slide-75
SLIDE 75

@samnewman @gotocph

slide-76
SLIDE 76

@samnewman @gotocph

http://krebsonsecurity.com/tag/target-data-breach/

slide-77
SLIDE 77

@samnewman @gotocph

Comms

slide-78
SLIDE 78

@samnewman @gotocph

Show teams with direct connection to users… Then show ‘backend services’ team Unified comms are needed!

slide-79
SLIDE 79

@samnewman @gotocph

slide-80
SLIDE 80

@samnewman @gotocph

slide-81
SLIDE 81

@samnewman @gotocph

https://en.wikipedia.org/wiki/Chicago_Tylenol_murders

slide-82
SLIDE 82

@samnewman @gotocph

http://www.smh.com.au/digital-life/mobiles/telstra-outage-manager-connected-customers-to-faulty-node-in-embarrassing- error-20160209-gmpn7f.html

slide-83
SLIDE 83

@samnewman @gotocph

"[The employee responsible] didn't follow procedures and clearly that's not a good thing but I wouldn't want to pre-empt the proper investigation and we'll figure out what the right response is when we've had a chance to dig into the detail."

  • Australian Financial Review

http://www.afr.com/business/telecommunications/telstra-mobile-network-down-across- australia-reports-20160209-gmpaty

slide-84
SLIDE 84

@samnewman @gotocph

https://vimeo.com/102167635

slide-85
SLIDE 85

@samnewman @gotocph

“Finding the root cause of a failure is like finding a root cause of a success.”

http://www.kitchensoap.com/2012/02/10/each-necessary-but-only-jointly-sufficient/

John Allspaw

slide-86
SLIDE 86

@samnewman @gotocph

http://www.smh.com.au/technology/technology-news/telstra-free-data-guy-clocks-up-almost- a-terabyte-of-downloads-20160404-gnxu14.html

slide-87
SLIDE 87

@samnewman @gotocph

Prevention Detection Response Recovery

slide-88
SLIDE 88

@samnewman @gotocph

Prevention Detection Response Recovery

slide-89
SLIDE 89

@samnewman @gotocph

Backups

slide-90
SLIDE 90

@samnewman @gotocph

Backups Burn it all down

slide-91
SLIDE 91

@samnewman @gotocph

Backups Burn it all down Harder with microservices?

slide-92
SLIDE 92

@samnewman @gotocph

Review your old post-mortems

slide-93
SLIDE 93

@samnewman @gotocph

Review your old post-mortems …and the resulting action plans!

slide-94
SLIDE 94

@samnewman @gotocph

Prevention Detection Response Recovery

slide-95
SLIDE 95

@samnewman @gotocph

Sam Newman

Building Microservices

DESIGNING FINE-GRAINED SYSTEMS

http://buildingmicroservices.com/

slide-96
SLIDE 96

@samnewman @gotocph

Sam Newman

Building Microservices

DESIGNING FINE-GRAINED SYSTEMS

http://buildingmicroservices.com/ http://samnewman.io/

slide-97
SLIDE 97

@samnewman @gotocph

Sam Newman

Building Microservices

DESIGNING FINE-GRAINED SYSTEMS

http://buildingmicroservices.com/ http://magpietalkshow.com/ http://samnewman.io/

slide-98
SLIDE 98