Successfully reported this slideshow.
We use your LinkedIn profile and activity data to personalize ads and to show you more relevant ads. You can change your ad preferences anytime.

Identiverse - Microservices Security

641 views

Published on

Slides from my sesion at Identiverse 2018 about Microservices Security

Published in: Technology
  • Be the first to comment

Identiverse - Microservices Security

  1. 1. Microservices security. How (not) to? Bertrand CARLIER bertrand.carlier@wavestone.com @bertrandcarlier
  2. 2. © WAVESTONE 2 2800+ consultants On 4 continents & 20+ fields of expertise Who am I? Cybersecurity practice 400+ consultants Paris, New York, London, Hong Kong Adressing all topics within cybersecurity Digital Identity 120+ experts in identity and access management Maturity assessments, roadmap definition, projects design & build Myself Fell into identity circa 2004, handcrafted SAML tokens circa 2007 Standards enthusiast and zelot ever since Remote attendee of Cloud ID Summit for years, first on-site CIS/Identiverse last year @bertrandcarlier
  3. 3. © WAVESTONE 3 Backend APIs What I mean when I say « microservices » An application calling an API endpoint… …calling another API endpoint …calling another API endpoint …calling other API endpoints … This generally also involves CI/CD tools and various degrees of automation Client APIAPI API API API API API API API Front APIs
  4. 4. © WAVESTONE 4 What I mean when I say « microservices » An application calling an API endpoint… …calling another API endpoint …calling another API endpoint …calling other API endpoints … This generally also involves CI/CD tools and various degrees of automation Client APIAPI API API API API API API API Backend APIsFront APIs
  5. 5. © WAVESTONE 5 How to secure microservices 101 Client APIAPI API API API API API API APIAPI Gateway OAuth2 Network isolation Authorization server
  6. 6. © WAVESTONE 6 If only it was that simple…
  7. 7. © WAVESTONE 7 What happens inside? Free all-you-can-reach buffet! Client APIAPI API API API API API API APIAPI Gateway Authorization server Should the front Access Token be propagated? What could the API Gateway swap the front token with? Which APIs can reach which APIs? ? ? ? ?? ? ? ? ? ? ?
  8. 8. © WAVESTONE 8 Option #1. Cleartext headers Client APIAPI API API API API API API APIAPI Gateway Authorization server Not really secure of course / Unless there is a strict network isolation in place, this allows for a lot of attack scenarios › Impersonation › Augmented authorizations › etc. A naïve approach / “Token offloading” at the gate / Developers don’t need to “do” security or crypto stuff {} {} {} {} {} {} {} {} {} {} {} {userid, client_id, access rights, etc.}
  9. 9. © WAVESTONE 9 Option #2. Token transmission Client APIAPI API API API API API API APIAPI Gateway Authorization server But still not the safest / Confused deputy attack: One compromised API allows compromising any network-reachable API (only with initial user identity) A slightly better solution / Allows for user identity & rights integrity / Developers might need to do crypto stuff › One could provide them with helper libraries › API Gateway round trip could be required
  10. 10. © WAVESTONE 10 Option #3. OAuth scopes Client API Gateway Authorization server APIAPI API API API API ? ? ? Still not perfect / Requires to know beforehand all required scopes in the chain / Often requires to define separated (business) API domains / In many cases this solution can be secure enough Introduce notion of service to service controls / API gateway and/or client can generate/manage several tokens with different scopes / Compromission spreading is limited API API API
  11. 11. © WAVESTONE 11 Option #4. Token Exchange Client API Gateway Authorization server APIAPI API API API API Of course it is not perfect / Introduces network latency to get each token / Can be a burden to developers (unless productized in a library) Fined-grained service-to-service control / Access tokens contain the user identity and the list of APIs went across / Authorization server and/or API can enforce any fine-grained policy they wish API API API
  12. 12. © WAVESTONE 12 And many other options! Service-to-service authentication / authorization / Mutual TLS / Client credential token / Self signed JWT / Nested self-signed JWT (see Will Tran’s work at https://github.com/william-tran/microxchg2017) Token validation / API gateway (ie. Reverse Proxy) / Embedded software library (ie. Agent) / Micro-gateways Main difficulties remain / Key management to authenticate services / sign tokens / Define/maintain/centralize fine-grained access policies / By-value JWT / By-reference token
  13. 13. © WAVESTONE 13 Case studies
  14. 14. © WAVESTONE 14 Cheese retail company
  15. 15. © WAVESTONE 15 Cheese retail company • Get or update inventory across branches • Get special deals in real time APIs for in-store sales people on mobile device • Real-time availability • Click to collect • Previous commands and receipts APIs for consumers • Mobile HR APIs • ERP APIs APIs for Human Resources and Finance Cheese supermarkets all over France and now a few other countries. We now have that goat cheese you loved back in stock! This Brie is available in a branch less than 10km from here! Our margin on Époisses is outstanding! This branche’s sales on Comté are really low That smelly Camembert is now 30% off for a limited time! That smelly Camembert is now 30% off for a limited time! This individual will get a 20% raise this year
  16. 16. © WAVESTONE 16 Inventory HR ERP Cheese retail company APIs Fence Network isolation Sub domain isolation / An API Gateway › Check the token validity › Serialize it / A “fence” per functional domain › Check user access rights › PaaS based network isolation › Domain-to-domain requests must go back through fences / Micro-services › Check client access rights An architecture based on three levels
  17. 17. © WAVESTONE 17 Big Bakery Company Pas la meilleur image !
  18. 18. © WAVESTONE 18 Big Bakery Company • New varieties of bread and croissant must hit the market before competitors • Agility to develop new products and means to trade them A classic story of digital transformation • Corporate clients do not want to access apps, they also want APIs • Internal dev teams also want to leverage data and operations through APIs APIs first • Spoiled pains au chocolat or sandwiches can cause severe health troubles • Recipes are very valuable assets that mustn’t leak Strong regulation A well established trading company in the bread and viennoiserie business I’ll just add a pinch of ginger… Let’s patch this croissant with almonds! /GET this sandwich before it expires or /DELETE it! Baguettes as a ServiceI can compose 1815 varieties of donuts now!
  19. 19. © WAVESTONE 19 Big Bakery Company Front APIs, using both user and application right Network isolation A very secure & robust architecture in theory / Token exchange from front to back / Client rights as scopes / User rights as custom claim But actually not fully leveraged / Only the front APIs check the user rights / Backend APIs only check the application rights and (implicitly) trust front APIs to check user rights Check app right Check user right Back-end APIs using only application right Reachable with token 1 Reachable with token 2 Reachable with token 3
  20. 20. © WAVESTONE 20 Wine Company
  21. 21. © WAVESTONE 21 Wine Company • Pay-as-you-drink, next bill estimation based on current consumption Wine as a Service • Suggestion based on previous tastings • AI powered advisor Wine advisor • Data sharing with wine amateurs social networks Third party services integration A utility company for wine. Millions of customers, With your Tournedos Rossini, I suggest you have a Margaux ‘62 I’d say you may very well like a Pommard To meet your target budget, you must have 2 more glasses € Congrats! You just earned the Burgundy Expert badge!
  22. 22. © WAVESTONE 22 Utilities – Wine as a Service Network isolation An approach based on point to point controls… / Using scope (and a strong scope governance) / Using both users and applications right, allows to ensure traceability Soon-to-be-in-production: a micro API Gateway / Deployed in front of each APIs in containers / Based on FOSS module (Apache & mod_auth_openidc) / A one-fits-all solution : Java, Ruby, Node.js, etc. Classical services Micro API Gateway Container
  23. 23. © WAVESTONE 23 3 different environments, 3 different solutions Development agility, feature teams independence Coarse-grained scopes, fine-grained user rights Business domain segregation Very risk averse environment, required traceability Fine-grained user and application rights Token exchange Heterogeneous technologies for API development, unsegmented network Moving to micro-gateways, leveraging CI/CD tools Micro gateways
  24. 24. © WAVESTONE 24 A few rules to balance API security design Different contexts will result in different architectures / Security requirements / Build & deployment automation capabilities / Gateway vs. agents vs. micro-gateways 1 Token transmission & scope management will fit most security requirements / Secure enough in most cases / Relatively easy to implement 2 Consider other options to cover additional security constraints / Service-to-service authentication / Token exchange or nested self-issued JWTs3
  25. 25. © WAVESTONE 25 There are many available blocks to achieve micro-services security. The main difficulty is to build it without mistakes
  26. 26. © WAVESTONE 26 Dou Ohote Raillte!
  27. 27. wavestone.com @wavestone_ Bertrand CARLIER Senior Manager M +33 (0)6 18 64 42 52 bertrand.carlier@wavestone.com riskinsight-wavestone.com @Risk_Insight securityinsider-solucom.fr @SecuInsider
  28. 28. PARIS LONDON NEW YORK HONG KONG SINGAPORE * DUBAI * SAO PAULO * LUXEMBOURG MADRID * MILANO * BRUSSELS GENEVA CASABLANCA ISTANBUL * LYON MARSEILLE NANTES * Partnerships

×