AppSec & Microservices - Velocity 2016

APPSEC & MICROSERVICESSam Newman Velocity 2016

@samnewman#velocityconf

Sam Newman

Building MicroservicesDESIGNING FINE-GRAINED SYSTEMS

Microservices Can Make Everything Worse

@samnewman#velocityconfhttps://www.flickr.com/photos/seattlemunicipalarchives/4058808950

@samnewman#velocityconf https://www.flickr.com/photos/theseanster93/485390997/

http://map.norsecorp.com/

Accounts

Returns

Invoicing

Shipping

Inventory

Customer Service

Accounts

Returns

Invoicing

Shipping

Inventory

Customer Service

Small Independently Deployable services that work together, modelled

around a business domain

https://www.flickr.com/photos/wwworks/2607036664/

https://www.flickr.com/photos/lkowen/15803718243/

Prevention

Prevention Detection

Response

ResponseRecovery

@samnewman#velocityconf https://www.flickr.com/photos/adulau/15680439035/

@samnewman#velocityconf https://www.flickr.com/photos/duanestorey/469163789/

https://www.schneier.com/paper-attacktrees-ddj-ft.html

Open Safe

Pick Lock Learn Combo Cut Open

Open Safe

Find Written Combo

Get Combo from the target

Open Safe

Find Written Combo

Blackmail Threaten Bribe

Open Safe

Find Written Combo

Impossible

Impossible ImpossiblePossible

Possible

Open Safe

Find Written Combo

Open Safe

Find Written Combo

$$$$ $$$$$$

Catalog service

Music Web Shop

Recommend service

Royalty Payment Gateway

Mobile app

Web browsers

User service

Catalog service

Music Web Shop

Recommend service

Mobile app

Web browsers

User service

Transport Security

HTTPS Everywhere!

BENEFITS OF HTTPS?

▫︎ Server guarantees!

BENEFITS OF HTTPS?

▫︎ Payload not manipulated…

BENEFITS OF HTTPS?

▫︎…but no client guarantee and…

BENEFITS OF HTTPS?

▫︎…but no client guarantee and…

▫︎…certificates can be a pain

https://letsencrypt.org/

Catalog service

Music Web Shop

Recommend service

Mobile app

Web browsers

User service

CLIENT-SIDE CERTIFICATES?

▫︎Client guarantees!

CLIENT-SIDE CERTIFICATES?

▫︎Client guarantees!

▫︎…but a PITA to manage….

http://techblog.netflix.com/2015/09/introducing-lemur.html

Catalog service

Music Web Shop

Recommend service

Mobile app

Web browsers

User service

Authentication

Authentication Authorisation

Catalog service

Music Web Shop

Recommend service

Mobile app

Web browsers

User service

Web browsers

Catalog service

Music Web Shop

Recommend service

Mobile app

Web browsers

User service

Web browsers

Form AuthOAuth

Catalog service

Music Web Shop

Recommend service

Mobile app

Web browsers

User service

Web browsers

Form AuthOAuthPERIMETER SECURITY!

Catalog service

Music Web Shop

Recommend service

Mobile app

Web browsers

User service

Web browsers

Form AuthOAuthPERIMETER SECURITY!

User service

Music Web Shop

User serviceUser

service

Implicit Trust?

Catalog service

Music Web Shop

Recommend service

Mobile app

Web browsers

User service

Web browsers

User service

Catalog service

Music Web Shop

Recommend service

Mobile app

Web browsers

User service

Web browsers

User service

Asking As Bob

Catalog service

Music Web Shop

Recommend service

Mobile app

Web browsers

User service

Web browsers

User service

Asking As Bob

Can I see Alice’s Data?

@samnewman#velocityconf https://www.flickr.com/photos/lundyd/14481829564/

Confused Deputy

Problem!

Music Web Shop

Web browsers

User service

Music Web Shop

Web browsers

User service

Music Web Shop

Web browsers

User service

Music Web Shop

Web browsers

User service

{ "id": "402ndj39", "name": “Alice Alison" }

Music Web Shop

Web browsers

User service

Music Web Shop

Web browsers

User service

Data At Rest?

Catalog service

Music Web Shop

Recommend service

Mobile app

Web browsers

User serviceUser

service

Encryption!

@samnewman#velocityconf https://www.flickr.com/photos/aigle_dore/2781302649

Plain Text?

“In the API server secret data is stored as plaintext in etcd"

http://kubernetes.io/docs/user-guide/secrets/#security-properties

Secure Vaults

Aside: Docker

http://www.banyanops.com/blog/analyzing-docker-hub/

S/M TestsBuild Large Tests Production

Security?

OWASP ZAP Attack ProxyStatic Analysers

@samnewman#velocityconf https://www.microsoft.com/en-us/sdl/

https://medium.com/built-to-adapt/the-three-r-s-of-enterprise-security-rotate-repave-and-repair-f64f6d6ba29d

“At or near the top of security concerns in the datacenter is something called an Advanced Persistent Threat (APT). An APT gains unauthorized access to a network and can stay hidden for a long period of time. Its goal is usually to steal, corrupt, or ransom data.”

- Justin Smith, Pivotal

Rotate: Short-lived Credentials

Repair: Patch Your Stuff

Repave: Burn It Down!

http://www.theregister.co.uk/2014/06/18/code_spaces_destroyed/

https://github.com/michenriksen/gitrob

(don’t forget to limit credential scope too)

ResponseRecovery

@samnewman#velocityconfhttps://www.qualys.com/research/top10/

http://www.extremetech.com/computing/190959-shellshock-a-deadly-new-vulnerability-that-could-lay-waste-to-the-internet

https://www.modsecurity.org/

Catalog service

Music Web Shop

Recommend service

Royalty service

Mobile app

Web browsers

User service

Catalog service

Music Web Shop

Recommend service

Royalty service

Mobile app

Web browsers

User service

PERIMETER SECURITY!

Catalog service

Music Web Shop

Recommend service

Royalty service

Mobile app

Web browsers

User service

PERIMETER SECURITY!

Catalog service

Music Web Shop

Recommend service

Royalty service

Mobile app

Web browsers

User service

PERIMETER SECURITY!

PERIMETER SECU

Polyglot = more stuff to track!

https://www.npmjs.com/package/npm-check

b4a2f5ga2

4335egad3

ab2d56be3

847ea3dbe

b4a2f5ga2

4335egad3

ab2d56be3

847ea3dbe !!!

b4a2f5ga2

4335egad3

ab2d56be3

847ea3dbe

4335egad34335egad3

4335egad3

847ea3dbe

https://github.com/coreos/clair

Automate it

Do It A Lot

Automate it

Do It A Lot

And Check Your Work

Polyglot = more things to break?

ResponseRecovery

@samnewman#velocityconf http://krebsonsecurity.com/tag/target-data-breach/

@samnewman#velocityconfhttps://en.wikipedia.org/wiki/Chicago_Tylenol_murders

Customer

ResponseRecovery

Backups

Repave: Burn It Down!

Phoenix Servers

Immutable Servers

Phoenix Servers

Immutable Servers= repave on every release

Why not repave automatically when you apply a patch?

RepaveBackups

Harder with microservices?

RepaveBackups

Harder with microservices?

RepaveBackups

AUTOMATE ALL THE THINGS

Post Mortems

http://www.smh.com.au/digital-life/mobiles/telstra-outage-manager-connected-customers-to-faulty-node-in-embarrassing-error-20160209-gmpn7f.html

"[The employee responsible] didn't follow procedures and clearly that's not a good thingbut I wouldn't want to pre-empt the proper investigation and we'll figure out what the right response is when we've had a chance to dig into the detail." - Australian Financial Review

http://www.afr.com/business/telecommunications/telstra-mobile-network-down-across-australia-reports-20160209-gmpaty

http://samnewman.io/blog/2016/02/10/telstra_outage/

https://vimeo.com/102167635

“Finding the root cause of a failure is like finding a root cause of a success.”

http://www.kitchensoap.com/2012/02/10/each-necessary-but-only-jointly-sufficient/

John Allspaw

http://www.smh.com.au/technology/technology-news/telstra-free-data-guy-clocks-up-almost-a-terabyte-of-downloads-20160404-gnxu14.html

Don’t forget to review your old post-mortems too…

…and the resulting action plans!

ResponseRecovery

Sam Newman

http://buildingmicroservices.com/

Sam Newman

http://samnewman.io/

Sam Newman

http://magpietalkshow.com/

http://samnewman.io/

Wednesday 22nd

Sam Newman

Signing

5.45pm

@ Oreilly Booth

@samnewman snewman@thoughtworks.com

THANKS!

AppSec & Microservices - Velocity 2016

Software

SC conference - Building AppSec Teams

Appsec Introduction

How HP Transformed its Architecture with Microservices and ... · Microservices SLA contracts API contracts. Why microservices? The answer is: Velocity. B C A D E Complex sync across

AppSec 101 - Eivind Arvesen

AppSec Survey 2.0 Fine-Tuning an AppSec Training Program Based on Data

Principles of microservices velocity

OWASP AppSec Europe 2009 Conference

Mobile Pentest Environment - AppSec Labs

Appsec SQL injection case study

AppSec++ Take the best of Agile, DevOps and CI/CD into your AppSec Program

Of microservices and microservices

Enabling Microservices @Orbitz - Velocity Conf 2015

Appsec usa2013 js_libinsecurity_stefanodipaola

AppSec And Microservices

Taking AppSec to 11 - Meetupfiles.meetup.com/18411966/Taking AppSec to 11... · Taking AppSec to 11: AppSec Pipelines, DevOps, and Making Things Better OWASP San Antonio, April 2016

AppSec Consulting Inc

Pass 2010 Appsec

Appsec obfuscator reloaded

Proactive Security AppSec Case Study

Appsec rump reverse-i_os_machook