Practical Microservice Security Laura Bell Practical Microservice - - PowerPoint PPT Presentation

▶
practical microservice security
SMART_READER_LITE
LIVE PREVIEW

Practical Microservice Security Laura Bell Practical Microservice - - PowerPoint PPT Presentation

Sep 27, 2023 378 likes •1.06k views

Practical Microservice Security Laura Bell Practical Microservice security Laura Bell Founder and Lead Consultant - SafeStack @lady_nerd laura@safestack.io http:/ /safestack.io caution: fast paced field ahead watch for out of date

slide-1
SLIDE 1

Practical Microservice Security

Laura Bell

slide-2
SLIDE 2

Laura Bell

Founder and Lead Consultant - SafeStack

@lady_nerd laura@safestack.io http:/ /safestack.io

Practical Microservice security

slide-3
SLIDE 3

caution: fast paced field ahead watch for out of date content

slide-4
SLIDE 4
slide-5
SLIDE 5

In this talk

Security Fundamentals

Some important points that are worth refreshing

Prevention

Avoid common vulnerabilities and avoid mistakes

Detection

Prepare for survival and response

slide-6
SLIDE 6
slide-7
SLIDE 7
slide-8
SLIDE 8
slide-9
SLIDE 9

apps that automatically scale up to handle millions of users and scale down again to have this be done by smaller teams

slide-10
SLIDE 10

Integrity Availability Confidentiality

slide-11
SLIDE 11

Spoofing Tampering Repudiation Information Disclosure Denial of Service Escalation of Privilege

slide-12
SLIDE 12
slide-13
SLIDE 13

Basic controls

slide-14
SLIDE 14

so bad that StackOverflow has a process to handle it

slide-15
SLIDE 15

For storing passwords in a database, MD5 is ac acceptab able, supposed you salt it properly. For this usage, the known attack is entirely unimportant. If you are in paranoia mode, you can use a more complicated scheme like bcrypt too, but for most people, storing a salted password is just good enough. It prevents the easiest, most

  • bvious attack, is easy to implement, hard to do wrong, and has

low overhead.

slide-16
SLIDE 16

https://www.owasp.org/index.php/REST_Security_Cheat_Sheet

find good trusted, peer reviewed sources

slide-17
SLIDE 17
  • r why acronyms make you less secure
slide-18
SLIDE 18

2FA

slide-19
SLIDE 19

Planned

slide-20
SLIDE 20

I’m sorry Dave, I can’t let you do that

slide-21
SLIDE 21

(fast updating, never cached, multi-device default)

slide-22
SLIDE 22

the keys to token success

slide-23
SLIDE 23

header field format method

slide-24
SLIDE 24

Service decomposition

slide-25
SLIDE 25

the reality of immature application segmentation

slide-26
SLIDE 26
slide-27
SLIDE 27

shouldn’t

slide-28
SLIDE 28
slide-29
SLIDE 29

exhaustion

slide-30
SLIDE 30

Orchestration layer attacks

slide-31
SLIDE 31

rule them all?

slide-32
SLIDE 32

<quote> protect your APIs from OWASP Top 10 threats such as SQL Injection, XSS and application DDoS, and adaptive threats such as bad bots. </quote>

slide-33
SLIDE 33

simple

slide-34
SLIDE 34

features that scare me

impersonation 2) investigation mode 3) demo accounts on production 4) SSL interception and analysis 5) many password sins

slide-35
SLIDE 35

Choose Restrict Monitor Configure Challenge Test

slide-36
SLIDE 36

never assume a security vendor is better at secure development than you are

slide-37
SLIDE 37
slide-38
SLIDE 38
slide-39
SLIDE 39

Identity and access management

slide-40
SLIDE 40

the lowest set of permissions and accesses required to do your job

slide-41
SLIDE 41

require well defined roles

slide-42
SLIDE 42

v.s.

slide-43
SLIDE 43

Automate and alert

slide-44
SLIDE 44

mature groups and role assistance

slide-45
SLIDE 45

Immutable architectures

matter in microservice security

slide-46
SLIDE 46

but you might not be the right person to audit them

slide-47
SLIDE 47

including those changes made by an attacker

slide-48
SLIDE 48

Typical Actions :

slide-49
SLIDE 49

become hard to persist

slide-50
SLIDE 50

Heterogeneous language and technology spaces

slide-51
SLIDE 51
slide-52
SLIDE 52

you

slide-53
SLIDE 53

technologies

slide-54
SLIDE 54

vulnerability management can be challenging in microservice architectures

slide-55
SLIDE 55
slide-56
SLIDE 56
slide-57
SLIDE 57

All

slide-58
SLIDE 58

secure location immutable format away from production

slide-59
SLIDE 59

denial of service attacks

slide-60
SLIDE 60

backup, health check, domains

slide-61
SLIDE 61

like actually, for real, not just when you’re debugging

slide-62
SLIDE 62

TL;DR

Security Fundamentals

Some important points that are worth refreshing

Prevention

Avoid common vulnerabilities and avoid mistakes

Detection

Prepare for survival and response

slide-63
SLIDE 63
slide-64
SLIDE 64
slide-65
SLIDE 65

Laura Bell

Founder and Lead Consultant - SafeStack

@lady_nerd laura@safestack.io http:/ /safestack.io

Questions?

slide-66
SLIDE 66