Security Patterns for Microservice Architectures

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Matt Raible | @mraible
September 3, 2020
Security Patterns For
Microservice Architectures
Photo by PURE - VIRTUAL on https...

@mraible
Who is Matt Raible?
Father, Husband, Skier, Mountain
Biker, Whitewater Rafter
Bus Lover
Web Developer and Java Ch...

@mraible
Why Microservices?
IF
you are developing a large/complex application
AND
you need to deliver it rapidly, frequent...

@mraible
The information on security patterns for
microservice security is limited
microservices.io
Why Security Patterns
...

Matt to the Rescue!

@mraible
11 Security Patterns for Microservice Architectures
1. Be Secure by Design
2. Scan Dependencies
3. Use HTTPS Ever...

@mraible
1. Be Secure by Design

Sanitize Input

@mraible
Remove Malicious Characters

Well-designed Software Architecture
is Important

@mraible
What About OWASP?

@mraible
What About OWASP?
https://www.infoq.com/podcasts/web-security-hack-anatomy
@J0hnnyXm4s

@mraible
Secure by Design Example

@mraible
Secure by Design Example

@mraible
Secure by Design Example

@mraible
2. Scan Dependencies

The (Application) Patching Manifesto
https://youtu.be/qVVZrTRJ290
“25% projects don’t report security issue; Majority only...

@mraible
GitHub and Dependabot

@mraible
GitHub and Dependabot

@mraible
Scan Dependencies

3. Use HTTPS Everywhere
https://howhttps.works

Use HTTPS Everywhere

HTTPS is Easy!

HTTPS for Static Sites too!
https://www.troyhunt.com/heres-why-your-static-website-needs-https

@mraible
TLS Certificates

@mraible
Get Free Certificates from Let’s Encrypt

@mraible
Use Certbot

@mraible
Use Certbot

@mraible
Use Certbot

@mraible
“Why do we need HTTPS
inside our network?”

Secure GraphQL APIs

Secure RSocket Endpoints
https://rsocket.io/https://rsocket.io

RSocket + Netifi
https://rsocket.io/https://www.netiﬁ.com/netiﬁ-ce

Learn More About RSocket
https://spring.io/blog/2020/03/02/getting-started-with-rsocket-spring-boot-server

@mraible
4. Use Access and Identity Tokens

@mraible
Secure Server-to-Server Communication

@mraible
Authorization Servers: Many to One

@mraible
Services can use access tokens to
talk to any other internal services
Single place to look for all definitions
Ea...

@mraible
Authorization Servers: One to One

@mraible
Clearly defined security boundaries Slower (more talking over the network)
Hard to manage
Many authorization serv...

@mraible Use PASETO Tokens Over JWT

Why JWTs Suck as Session Tokens
https://developer.okta.com/blog/2017/08/17/why-jwts-suck-as-session-tokens

@mraible
How PASETOs Work
https://developer.okta.com/blog/2019/10/17/a-thorough-introduction-to-paseto

@mraible
5. Encrypt and Protect Secrets

HashiCorp Vault and Azure Key Vault

https://developer.okta.com/blog/2020/05/04/spring-vault
Secure Secrets With Spring Cloud Config and Vault

Amazon Key Management Service (KMS)

6. Verify Security with Delivery Pipelines

@mraible
7. Slow Down Attackers
Beyond CI/CD: How
Continuous Hacking of
Docker Containers and
Pipeline Driven Security
Kee...

@mraible
Create a whitelist of base images
Pull only cryptographically signed base images
Sign the metadata of a published...

@mraible
Run static code analysis for known vulnerabilities
Run automated dependency checkers to ensure latest versions
Sp...

@mraible
7. Slow Down Attackers

@mraible
8. Use Docker Rootless Mode

9. Use Time-Based Security

https://developer.okta.com/blog/2019/12/19/multi-factor-authentication-sucks
Sidenote: Randall’s Thoughts on MFA

https://developer.okta.com/blog/2019/12/19/multi-factor-authentication-sucks
Sidenote: Randall’s Thoughts on MFA

@mraible
10. Scan Docker and K8s Configurations

Docker
Image
Security Best
Practices
https://snyk.io
In Snyk’s State of open source security report 2019, we found each of...

Top 5 Docker Vulnerabilities
https://resources.whitesourcesoftware.com/blog-whitesource/top-5-docker-vulnerabilities

@mraible
11. Know Your Cloud and Cluster Security

@mraible
The 4C’s of Cloud Native Security
https://unsplash.com/photos/_uAVHAMjGYAhttps://kubernetes.io/docs/concepts/secu...

@mraible
7. Statically Analyze YAML
8. Run Containers as a Non-Root
User
9. Use Network Policies
(to limit traffic between...

Run a Service Mesh
https://www.redhat.com/en/topics/microservices/what-is-a-service-mesh

@mraible
1. Be Secure by Design
2. Scan Dependencies
3. Use HTTPS Everywhere
4. Use Access and Identity Tokens
5. Encrypt ...

@mraible
Action!

@mraible
Learn More About API Security
1. Transport Layer Security
2. DOS Mitigation Strategies
3. Sanitizing Data
4. M...

developer.okta.com/blog
@oktadev

Read the Blog Post
https://developer.okta.com/blog/2020/03/23/microservice-security-patterns

Thanks!
Keep in Touch
raibledesigns.com
@mraible
Presentations
speakerdeck.com/mraible
Code
github.com/oktadeveloper
devel...

developer.okta.com

Share SlideShare

Facebook
Twitter
LinkedIn

Embed

Size (px)

Show related SlideShares at end

WordPress Shortcode

Link

Share
Email

ChatGPT and the Future of Work - Cl... by Clark Boyd 7712 views
Getting into the tech field. what n... by Tessa Mero 1565 views
Google's Just Not That Into You: Un... by Lily Ray 3481 views
How to have difficult conversations by Rajiv Jayarajah, ... 2033 views
Introduction to Data Science by Christy Abraham Joy 81655 views
Time Management & Productivity - B... by Vit Horky 169409 views

Top clipped slide

1 of 74 Ad

1 of 74 Ad