Downloaded 96 times
![@samnewman#velocityconf
"[The employee responsible] didn't follow
procedures and clearly that's not a good thing
but I wouldn't want to pre-empt the proper
investigation and we'll figure out what the right
response is when we've had a chance to dig into
the detail."
- Australian Financial Review
http://www.afr.com/business/telecommunications/telstra-mobile-network-down-across-
australia-reports-20160209-gmpaty](https://image.slidesharecdn.com/securing-microservicesvelocity-90mins-160623231002/75/AppSec-Microservices-Velocity-2016-148-2048.jpg)
Uploaded bySam Newman
AppSec & Microservices - Velocity 2016
This document appears to be a transcript from a presentation on application security and microservices. The summary includes: 1) The presentation discusses security challenges and strategies for microservices architectures, including transport security, authentication, authorization, encryption of data at rest, and perimeter security approaches. 2) Prevention, detection, response and recovery are emphasized as important aspects of a security strategy, along with practices like short-lived credentials, patching, and "repaving" or rebuilding systems on deployments. 3) Managing security risks across polyglot systems is highlighted as a challenge, as is the need to automate security practices and conduct thorough post-mortem analyses of incidents.
More Related Content
Similar to AppSec & Microservices - Velocity 2016
AppSec & Microservices - Velocity 2016
- 1.
- 2.
- 3.
- 4.
- 5.
- 6.
- 7.
- 8.
- 9.
- 10.
- 11.
- 12. @samnewman#velocityconf Accounts Returns Invoicing Shipping Inventory Customer Service Small Independently Deployable servicesthat work together, modelled around a business domain
- 13.
- 14.
- 15.
- 16.
- 17.
- 18.
- 19.
- 20.
- 21.
- 22.
- 23.
- 24.
- 25.
- 26.
- 27.
- 28.
- 29.
- 30. @samnewman#velocityconf Open Safe Pick LockLearn Combo Cut Open
- 31. @samnewman#velocityconf Open Safe Pick LockLearn Combo Cut Open Find Written Combo Get Combo from the target
- 32. @samnewman#velocityconf Open Safe Pick LockLearn Combo Cut Open Find Written Combo Get Combo from the target Blackmail Threaten Bribe
- 33. @samnewman#velocityconf Open Safe Pick LockLearn Combo Cut Open Find Written Combo Get Combo from the target Blackmail Threaten Bribe Impossible Impossible Impossible Possible Possible Possible
- 34. @samnewman#velocityconf Open Safe Pick LockLearn Combo Cut Open Find Written Combo Get Combo from the target Blackmail Threaten Bribe
- 35. @samnewman#velocityconf Open Safe Pick LockLearn Combo Cut Open Find Written Combo Get Combo from the target Blackmail Threaten Bribe $$$$ $$$$ $$$$ $$ $$ $
- 36.
- 37.
- 38.
- 39.
- 40. BENEFITS OF HTTPS? ▫︎Serverguarantees!
- 41. BENEFITS OF HTTPS? ▫︎Serverguarantees! ▫︎Payload not manipulated…
- 42. BENEFITS OF HTTPS? ▫︎Serverguarantees! ▫︎Payload not manipulated… ▫︎…but no client guarantee and…
- 43. BENEFITS OF HTTPS? ▫︎Serverguarantees! ▫︎Payload not manipulated… ▫︎…but no client guarantee and… ▫︎…certificates can be a pain
- 44.
- 45.
- 46.
- 47.
- 48.
- 49. CLIENT-SIDE CERTIFICATES? ▫︎Client guarantees! ▫︎…buta PITA to manage….
- 50.
- 51.
- 52.
- 53.
- 54.
- 55.
- 56.
- 57.
- 58.
- 59.
- 60.
- 61.
- 62.
- 63.
- 64.
- 65.
- 66.
- 67.
- 68.
- 69.
- 70.
- 71.
- 72.
- 73.
- 74.
- 75.
- 76. @samnewman#velocityconf “In the APIserver secret data is stored as plaintext in etcd" http://kubernetes.io/docs/user-guide/secrets/#security-properties
- 77.
- 78.
- 79.
- 80.
- 81.
- 82.
- 83.
- 84. @samnewman#velocityconf S/M TestsBuild LargeTests Production
- 85. @samnewman#velocityconf S/M TestsBuild LargeTests Production Security?
- 86. @samnewman#velocityconf S/M TestsBuild LargeTests Production Security? OWASP ZAP Attack Proxy Static Analysers
- 87.
- 88.
- 89. @samnewman#velocityconf “At or nearthe top of security concerns in the datacenter is something called an Advanced Persistent Threat (APT). An APT gains unauthorized access to a network and can stay hidden for a long period of time. Its goal is usually to steal, corrupt, or ransom data.” - Justin Smith, Pivotal
- 90.
- 91.
- 92. @samnewman#velocityconf Rotate: Short-lived Credentials Repave:Burn It Down! Repair: Patch Your Stuff
- 93.
- 94.
- 95. @samnewman#velocityconf (don’t forget tolimit credential scope too)
- 96.
- 97.
- 98.
- 99.
- 100.
- 101.
- 102.
- 103.
- 104.
- 105.
- 106.
- 107. @samnewman#velocityconf Polyglot = morestuff to track!
- 108.
- 109.
- 110.
- 111.
- 112.
- 113.
- 114.
- 115. @samnewman#velocityconf Repair: Patch YourStuff Automate it
- 116. @samnewman#velocityconf Repair: Patch YourStuff Automate it Do It A Lot
- 117. @samnewman#velocityconf Repair: Patch YourStuff Automate it Do It A Lot And Check Your Work
- 118.
- 119. @samnewman#velocityconf Polyglot = morethings to break?
- 120.
- 121.
- 122.
- 123.
- 124.
- 125.
- 126.
- 127.
- 128.
- 129.
- 130.
- 131.
- 132.
- 133.
- 134.
- 135.
- 136.
- 137.
- 138.
- 139.
- 140.
- 141. @samnewman#velocityconf Phoenix Servers Immutable Servers =repave on every release
- 142. @samnewman#velocityconf Why not repaveautomatically when you apply a patch?
- 143.
- 144.
- 145.
- 146.
- 147.
- 148. @samnewman#velocityconf "[The employee responsible]didn't follow procedures and clearly that's not a good thing but I wouldn't want to pre-empt the proper investigation and we'll figure out what the right response is when we've had a chance to dig into the detail." - Australian Financial Review http://www.afr.com/business/telecommunications/telstra-mobile-network-down-across- australia-reports-20160209-gmpaty
- 149.
- 150.
- 151. @samnewman#velocityconf “Finding the rootcause of a failure is like finding a root cause of a success.” http://www.kitchensoap.com/2012/02/10/each-necessary-but-only-jointly-sufficient/ John Allspaw
- 152.
- 153. @samnewman#velocityconf Don’t forget toreview your old post-mortems too…
- 154. @samnewman#velocityconf Don’t forget toreview your old post-mortems too… …and the resulting action plans!
- 155.
- 156. @samnewman#velocityconf Sam Newman Building Microservices DESIGNING FINE-GRAINEDSYSTEMS http://buildingmicroservices.com/
- 157. @samnewman#velocityconf Sam Newman Building Microservices DESIGNING FINE-GRAINEDSYSTEMS http://buildingmicroservices.com/ http://samnewman.io/
- 158. @samnewman#velocityconf Sam Newman Building Microservices DESIGNING FINE-GRAINEDSYSTEMS http://buildingmicroservices.com/ http://magpietalkshow.com/ http://samnewman.io/
- 159. @samnewman#velocityconf Wednesday 22nd Sam Newman Building Microservices DESIGNINGFINE-GRAINED SYSTEMS Signing 5.45pm @ Oreilly Booth
- 160.