SLIDE 1
@voit3k
PRINCIPAL DEVELOPER / TECH LEAD
Wojciech Lesniak
MICROSERVICES SECURITY CHALLENGES
Microservices
International Data Corporation (IDC) predicts that by: 2019 Q1
Microservices Security Fundamentals MICROSERVICES SECURITY - - PowerPoint PPT Presentation
Microservices Security Fundamentals MICROSERVICES SECURITY - - PowerPoint PPT Presentation
Microservices Security Fundamentals MICROSERVICES SECURITY CHALLENGES Wojciech Lesniak PRINCIPAL DEVELOPER / TECH LEAD @voit3k Microservices International Data Corporation (IDC) predicts that by: 2019 Q1 Microservices International Data
SLIDE 2
SLIDE 3
Microservices
90%
Of all applications will feature microservices architectures that improve the ability to design, debug, update, and leverage third-party code. 2022 Q2 International Data Corporation (IDC) predicts that by:
SLIDE 4
Polyglot Each service can implement its own technology stack
Flexibility a Microservices Architecture
Agile Teams Smaller independent Teams Independent Developed, deployed and scaled independently
SLIDE 5
Microservices the promised land
SLIDE 6
API Gateway
Microservices Architecture Patterns
Service discovery Distributed tracing Client load balancing
SLIDE 7
Stifling team productivity. Reduce the performance or time to market
- f the application.
Negating any of the benefits a microservices architecture.
How do you secure your Microservices without ?
SLIDE 8
Bugs in Microservices
Fix, test and deploy the offending microservice.
SLIDE 9
Fail Fast Fail Early Fail Often
SLIDE 10
Reputational and brand damage Loss of trust Financial loss
Consequences of Security Breaches
Legal issues Bankruptcy Negative headlines
SLIDE 11
There are also tried and tested best practices and architectural patterns you can use to solve the security challenges within your Microservices architecture.
SLIDE 12
DevOps: Security is now everyone's responsibility.....
SLIDE 13
Draconian Excessively harsh, severe and lock everything down
Your Security Implementation Should Not Be
SLIDE 14
The Challenges of Microservices Security
SLIDE 15
Monolith Microservices
Contrast Security Challenges
SLIDE 16
Security Fundamentals and Prevention
- the various techniques and patterns you
can use secure your microservices architecture.
SLIDE 17
Hackers Are Lazy
SLIDE 18
SLIDE 19
Detection
Identifying security vulnerabilities throughout the development lifestyle. Monitoring and identifying security breaches. Reacting to security breaches.
SLIDE 20
Threat Modelling Prioritize security vulnerabilities
Engrain a Security Culture within Your Development Teams
SLIDE 21
Is an information assurance concept in which multiple layers
- f security controls (defence) are placed throughout an
information technology (IT) system. Also known as a castle approach.
Defenc nce i in D n Depth
SLIDE 22
SLIDE 23
Monolith Microservices
SLIDE 24
Monolith Microservices
Contrast Security Challenges
SLIDE 25
Monolith Microservices
SLIDE 26
Data Access Pricing Support HTML Portfolio REST
PORT: 80
Account
in-process
Session Smaller attack surface. In-process communication between components is more secure. User context is stored centrally, easily retrievable and trusted.
Mono nolith th
SLIDE 27
Data Access Support REST Data Access Account REST Data Access Portfolio REST
Microservices
Data Access Pricing REST
SLIDE 28
Confused Deputy
JS HTML Service GET: /victoria Victoria Data Access Account REST Data Access Portfolio REST GET: /joe
SLIDE 29
Data Access Support REST Data Access Account REST Data Access Portfolio REST
Bootstrapping Secrets
Data Access Pricing REST
Env variables Env variables Env variables Env variables
SLIDE 30
Secret Sprawl
Property file Env variables Source code Configuration management Source control
SLIDE 31
Challenges with immutable servers
- Secrets and whitelists cannot be
maintained on the servers file system.
Data Access Portfolio REST Immutable Server Docker Container Microservice
SLIDE 32
Security is not just authentication and authorization, it’s also quality of service
SLIDE 33
Denial of Service
SLIDE 34
SLIDE 35
Netflix Microservices Architecture
SLIDE 36
Monitoring and Tracing
Queue
SLIDE 37
Queue
SLIDE 38
Challenges due to polyglot Challenges due to polyglot mic icroser ervic ices es a archit itec ectures es. Requires security expertise for each technology. Maintaining multiple sets of security best practices and guidelines for each technology. Keeping up with security patches. Queue
SLIDE 39
Your Microservices security implementation should not:
- Resemble a monolith.
- Prevent your service from being
scaled and deployed independently.
- Degrade your applications
performance.
- Stifle team productivity.
- Prevent or restrict your teams from
experimenting and selecting different technology stacks.
Key Takeways