TALK | Services are exposed on the Internet and can be accessed by anyone and may have untrusted users

1. Designing secure cloud
applications

2. A few benefits of moving to the cloud @adoranwodo

3. But with all this enjoyment comes responsibility
@adoranwodo

4. Human error / mistakes
Malicious attacks
Legal / compliance issues
Security risks in cloud applications @adoranwodo

5. Hi, I’m Adora!
Software Engineer, Microsoft Mixed Reality
Tech Content Creator, AdoraHack
Co-Founder, unStack
Advisory Board, VRARA Nigeria
@adoranwodo
@adoranwodo

6. SECURITY CHECKLIST
Analyse and understand what/how your application needs to be secured
@adoranwodo

7. Will my application contain sensitive customer data?
Where and how is my applications data stored?
Will this application be available over the internet (publicly) or just internally?
How do I plan to verify my users identity?
What sensitive tasks are performed in my application?
Does my application perform any risky software activities?
@adoranwodo

8. Data protection Identity Management
Federated Identity
Valet Key
PATTERNS
Gatekeeper
PATTERNS
@adoranwodo

9. GATEKEEPER PATTERN
Data protection scenario
@adoranwodo

10. @adoranwodo

11. @adoranwodo

12. VALET KEY PATTERN
Identity management scenario
@adoranwodo

13. @adoranwodo

14. public class ValuesController : ApiController
{
private readonly BlobServiceClient blobServiceClient;
private readonly string blobContainer;
...
/// <summary>
/// Return a limited access key that allows the caller to upload a file
/// to this specific destination for a defined period of time (10 minutes).
/// </summary>
private StorageEntitySas GetSharedAccessReferenceForUpload(string blobName)
{
var blob = blobServiceClient.GetBlobContainerClient(this.blobContainer).GetBlobClient(blobName);
var storageSharedKeyCredential = new StorageSharedKeyCredential(blobServiceClient.AccountName,
ConfigurationManager.AppSettings["AzureStorageEmulatorAccountKey"]);
var blobSasBuilder = new BlobSasBuilder
{
BlobContainerName = this.blobContainer,
BlobName = blobName,
Resource = "b",
StartsOn = DateTimeOffset.UtcNow.AddMinutes(-10),
ExpiresOn = DateTimeOffset.UtcNow.AddMinutes(10)
};
policy.SetPermissions(BlobSasPermissions.Write);
var sas = policy.ToSasQueryParameters(storageSharedKeyCredential).ToString();
return new StorageEntitySas
{
BlobUri = blob.Uri,
Credentials = sas
};
}
public struct StorageEntitySas
{
public string Credentials;
public Uri BlobUri;
}
} Code snippet from docs.microsoft.com
@adoranwodo

15. FEDERATED IDENTITY PATTERN
Identity management scenario
@adoranwodo

16. Claims based access control @adoranwodo

17. OTHER WAYS TO ENFORCE SECURITY
@adoranwodo

18. Use multi-factor authentication
Consider Implementing JIT(Just In Time) access for resources
Use stable AuthN & AuthZ platforms
Require re-authentication for some actions (e.g. financial transactions)
Identity @adoranwodo

19. Reduce your attack surface
Properly handle errors and exceptions
Properly monitor your service and trigger alerts about issues
Encrypt sensitive data
Implement fail-safe measures
Consider threat modelling
Core security @adoranwodo

20. Core security - Threat modelling @adoranwodo
S - Spoofing attacks
T - Tampering
R - Repudiation
I - Information disclosure
D - Denial of service
E - Elevation of privilege

21. Use secure libraries
Update service dependencies to prevent vulnerabilities
Avoid hardcoding. Always reference secrets from a secrets manager
Bonus - Implementation @adoranwodo

22. https://docs.microsoft.com/en-us/azure/security/develop/secure-design
https://docs.microsoft.com/en-us/azure/architecture/patterns/federated-identity
https://techbeacon.com/app-dev-testing/cloud-app-security-how-not-fail
https://docs.microsoft.com/en-us/azure/security/fundamentals/paas-deployments
https://www.ibm.com/cloud/architecture/architectures/securityArchitecture/implement-secure-devops
Additional reading @adoranwodo

23. Thank you!
www.adoranwodo.com
@adoranwodo