Fast Forward Reflecting on a Life of Watching Movies and a Career - - PowerPoint PPT Presentation

▶
fast forward
SMART_READER_LITE
LIVE PREVIEW

Fast Forward Reflecting on a Life of Watching Movies and a Career - - PowerPoint PPT Presentation

Jun 28, 2023 337 likes •1.08k views

Fast Forward Reflecting on a Life of Watching Movies and a Career in Security Jason Chan VP, Information Security @ Netflix @chanjbs Credit: @LoulouHoltz So . . . what does this have to do with security? Credit: @matt_tesauro Back to the

slide-1
SLIDE 1

Fast Forward

Reflecting on a Life of Watching Movies and a Career in Security

Jason Chan VP, Information Security @ Netflix @chanjbs

slide-2
SLIDE 2
slide-3
SLIDE 3
slide-4
SLIDE 4

Credit: @LoulouHoltz

slide-5
SLIDE 5
slide-6
SLIDE 6
slide-7
SLIDE 7
slide-8
SLIDE 8
slide-9
SLIDE 9

So . . . what does this have to do with security?

slide-10
SLIDE 10
slide-11
SLIDE 11
slide-12
SLIDE 12
slide-13
SLIDE 13
slide-14
SLIDE 14
slide-15
SLIDE 15
slide-16
SLIDE 16
slide-17
SLIDE 17

Credit: @matt_tesauro

slide-18
SLIDE 18

Back to the movies . . .

slide-19
SLIDE 19
slide-20
SLIDE 20

Core Functionality Security Migrations Upgrades Other Campaigns Change Deployment Infrastructure Technology Standards Operations Basics Observability Performance Reliability Scalability Non-Functional Requirements

slide-21
SLIDE 21

Reducing Cognitive Load for Developers

slide-22
SLIDE 22
slide-23
SLIDE 23
slide-24
SLIDE 24
slide-25
SLIDE 25

Simplifying the Security Interface for Developers

slide-26
SLIDE 26

Are you trying to make your engineers security experts? Or do you just want them to build and

  • perate secure systems?
slide-27
SLIDE 27

What security functions can we abstract to simplify the developer experience?

slide-28
SLIDE 28

Netflix Studio Engineering

slide-29
SLIDE 29
slide-30
SLIDE 30
slide-31
SLIDE 31

Netflix Studio Engineering

Optimize production from “pitch to play” Lots of innovation and iteration

slide-32
SLIDE 32

Netflix Studio User

Studio LOB App A Studio LOB App N

Netflix Studio Apps

slide-33
SLIDE 33

Simplify and Improve Security through Functionality Abstraction

slide-34
SLIDE 34

Leverage Netflix OSS - Zuul

“built to enable dynamic routing, monitoring, resiliency and security”

https://github.com/Netflix/zuul/wiki

slide-35
SLIDE 35

Netflix Studio User

Studio LOB App A Studio LOB App N

Netflix Studio Apps with Zuul and Wall-E

Wall-E

Rate Limit IP Blacklist Authentication Authorization SigSci WAF Schema Check Schema Check Sec Headers DLP Pre-Filters Post-Filters

slide-36
SLIDE 36
slide-37
SLIDE 37

Results

Lower cognitive load for

  • nboarding security

Centralized and managed functionality Frees developers to build the Netflix Studio!

slide-38
SLIDE 38
slide-39
SLIDE 39

Monolith to microservices: network Immutable infra: OS, custom app, middleware Infra as code: Everything!

Blurring Lines: App and Infra

slide-40
SLIDE 40

Tackling App and Infra Integration: Seamless Least Privilege

slide-41
SLIDE 41

Instances Hadoop Email Services Storage Database Message Queue

The Magic of IaaS

slide-42
SLIDE 42

Ex: Cloud Based Word Processor

slide-43
SLIDE 43

Ex: Cloud Based Word Processor

{

"Effect": "Allow", "Action": ["*:*"] "Resource": "*"

}

slide-44
SLIDE 44

Ex: Cloud Based Word Processor

{

"Effect": "Allow", "Action": ["s3:*"] "Resource": "*"

}

slide-45
SLIDE 45

Ex: Cloud Based Word Processor

{

"Effect": "Allow", "Action": ["s3:GetObject", "s3:PutObject"] "Resource": "*"

}

slide-46
SLIDE 46

Ex: Cloud Based Word Processor

{

"Effect": "Allow", "Action": ["s3:GetObject", "s3:PutObject"] "Resource": "arn:aws:s3:::wp_bucket"

}

slide-47
SLIDE 47
slide-48
SLIDE 48

AWS provides data about API use This data acts as a basis for action

slide-49
SLIDE 49

When a new application is created, we provide a base set of permissions

s3:GetObject s3:PutObject ... ... ... ... sqs:ReceiveMessage

slide-50
SLIDE 50

We observe the application to see which permissions are actually used

slide-51
SLIDE 51

We then remove unused permissions

s3:GetObject s3:PutObject ... ... ... ... sqs:ReceiveMessage

slide-52
SLIDE 52

We then remove unused permissions

s3:GetObject s3:PutObject ... ... ... ... sqs:ReceiveMessage

slide-53
SLIDE 53

Available as OSS - Repokid

https://github.com/Netflix/repokid

slide-54
SLIDE 54
slide-55
SLIDE 55

Results

Low-risk access reduction Transparent and versioned ops Innovation and high-velocity development without friction

slide-56
SLIDE 56
slide-57
SLIDE 57

Potential for “Controlled” Anarchy

Microservices YBIYRI Polyglot and multiple tech stacks Independent deployments Intentionally decentralized governance leads to increased attack surface

slide-58
SLIDE 58
slide-59
SLIDE 59
slide-60
SLIDE 60

Managing the Anarchy

slide-61
SLIDE 61
slide-62
SLIDE 62
  • Well-supported solutions from central teams
  • Clarifies and evangelizes successful patterns and

practices

  • Automated observation and evaluation of adoption
  • Provides a standard way of interfacing with engineering

teams about security

  • Uncover risk and reward operational excellence

The Security Paved Road

slide-63
SLIDE 63

Security Paved Road (ex.)

Example Solutions & Measures Per-app IAM role Per-app Security Group No secrets in code Instance identity Updated machine image

slide-64
SLIDE 64

Security Paved Road

Quarterly Change Cycle Commit to update once per quarter to pull in upgrades, library changes, and modifications to paved road components

slide-65
SLIDE 65
slide-66
SLIDE 66

Security Paved Road

Security Brain Make our expectations, asks, and recommendations explicit and easy to navigate

slide-67
SLIDE 67

Customized view for the user Open security issues Recommended practices

slide-68
SLIDE 68

Most security backlog is standard; explicitly limit bespoke/custom backlog

slide-69
SLIDE 69
slide-70
SLIDE 70
slide-71
SLIDE 71

In closing . . .

slide-72
SLIDE 72

Overall Takeaways

Stay attuned to trends Simplify and standardize Favor transparent decisions Measure adoption and uptake Get comfortable with tradeoffs

slide-73
SLIDE 73

Thank you! @chanjbs