Video and slides synchronized, mp3 and slide download available at URL http://bit.ly/2bO7jt1. Ryan Lane talks about the methods for handling various types of security problems in cloud services as well as the tools they use at Lyft including Google SAML/OAuth2, Octa for identity management/SSO, Confidant, Vault, Sneaker, Credstash and Keywhiz for secret management, Confidant and KMS for secure bootstrapping, and metadataproxy and ec2metaproxy for limiting access to Docker containers. Filmed at qconnewyork.com. Ryan Lane is a Security Engineer at Lyft. He's the maintainer of a number of Lyft's Open Source security products, like Confidant, metadataproxy and bandit-high-entropy-string. Ryan also wrote and maintains the AWS orchestration code in SaltStack and is a major contributor to Wikimedia and OpenStack projects.

1. Ryan Lane - Jun 13, 2016
Identity, Access and Secret Management

2. InfoQ.com: News & Community Site
• 750,000 unique visitors/month
• Published in 4 languages (English, Chinese, Japanese and Brazilian
Portuguese)
• Post content from our QCon conferences
• News 15-20 / week
• Articles 3-4 / week
• Presentations (videos) 12-15 / week
• Interviews 2-3 / week
• Books 1 / month
Watch the video with slide
synchronization on InfoQ.com!
https://www.infoq.com/presentations/
lyft-security-cloud

3. Presented at QCon New York
www.qconnewyork.com
Purpose of QCon
- to empower software development by facilitating the spread of
knowledge and innovation
Strategy
- practitioner-driven conference designed for YOU: influencers of
change and innovation in your teams
- speakers and topics driving the evolution and innovation
- connecting and catalyzing the influencers and innovators
Highlights
- attended by more than 12,000 delegates since 2007
- held in 9 cities worldwide

4. Example service

5. Example service

6. Example service

7. Example service Multiple environments

9. Identity
SaaS/Web Services
SSO with API
SSO without API
No SSO with API
No SSO, without API
EC2 user identity

10. SSO:
SAML

11. SSO: SAML
• Google
• Onelogin
• Okta
• Ping Identity
• …
Providers:

12. SSO: OpenID
Dead end.

13. SSO: OpenID Connect (OAuth2 + OpenID)
• Google
• Facebook
• Okta
• Ping Identity
• …
Providers:

14. No SSO…

15. No SSO with API

16. SSO with API

17. No SSO, No API

18. Secrets Files

19. No SSO, No API
Password
Management.

20. What
about
LDAP?

21. Die In a Fire, LDAP
nsscache

22. Die In a Fire, LDAP

23. Access controls
Ensuring
least
privilege

24. Access Control

25. Access Control

26. Access Control
Docker

27. Access Control
Docker

28. SSH management

29. SSH management

30. SSH management

31. Secrets
Limiting
footprint,
scope, and
access.

33. Hardcoded
Secrets

34. Secret Management

35. GPG

36. Sneaker

37. Vault

38. Confidant

39. KMS Auth Token
token = kms_client.encrypt(
KeyId=‘alias/authnz’,
Plaintext=(
’{“not_before”:“20160613T100000Z”,’
‘”not_after”:“20160613T110000Z”}’
),
EncryptionContext={
‘from’: ‘service-a’,
‘to’: ‘service-b’,
‘user_type’: ‘service’
}
)[‘CiphertextBlob’]

40. IAM policy
‘confidant-authnz-encrypt’:
Version: ‘2012-10-17’
Statement:
- Action:
- ‘kms:Encrypt’
Effect: ‘Allow’
Resource: ‘arn:aws:kms:us-east-1:1234:key/…’
Condition:
StringEquals:
‘kms:EncryptionContext:from’: ‘service-a‘
‘kms:EncryptionContext:user_type’: ‘service’
StringLike:
‘kms:EncryptionContext:to’: ‘*’

41. IAM policy
‘confidant-authnz-decrypt’:
Version: ‘2012-10-17’
Statement:
- Action:
- ‘kms:Decrypt’
Effect: ‘Allow’
Resource: ‘arn:aws:kms:us-east-1:1234:key/…’
Condition:
StringEquals:
‘kms:EncryptionContext:to’: ‘confidant-production’
‘kms:EncryptionContext:user_type’: ‘*’
StringLike:
‘kms:EncryptionContext:from’: ‘*’

42. Service to service auth

43. User to service auth

44. Bandit

45. Bandit

46. Thank
You.

47. @squiddlane
rlane@lyft.com

48. Watch the video with slide synchronization on
InfoQ.com!
https://www.infoq.com/presentations/lyft-
security-cloud