Securing Kafka Connect Pipelines with Client-Side Field-Level Crypt...

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Securing
Kafka Connect Pipelines
with Client-Side
field level Cryptography
@hpgrahsl | #KafkaSummit April 25-26, 2022 | Lo...

Why should we care?
@hpgrahsl | #KafkaSummit April 25-26, 2022 | London
2

61%
of breaches involved
credential data1
1
Verzion DBIR 2021 - https://www.verizon.com/dbir
@hpgrahsl | #KafkaSummit Apri...

85%
of breaches involved
the human element1
1
Verzion DBIR 2021 - https://www.verizon.com/dbir
@hpgrahsl | #KafkaSummit Ap...

@hpgrahsl | #KafkaSummit April 25-26, 2022 | London
5

compromised external
cloud assets
more common than
on-premises assets1
1
Verzion DBIR 2021 - https://www.verizon.com/dbir
...

Don't
forget about the price tag
of data breaches.
@hpgrahsl | #KafkaSummit April 25-26, 2022 | London
7

Don't
forget about the price tag
of data breaches.
@hpgrahsl | #KafkaSummit April 25-26, 2022 | London
8

$4.24M
average cost of data
breach2
2
IBM Cost of Data Breach Report - https://www.ibm.com/security/data-breach
@hpgrahsl ...

$180
per record cost of
customer pii2
2
IBM Cost of Data Breach Report - https://www.ibm.com/security/data-breach
@hpgrahs...

@hpgrahsl | #KafkaSummit April 25-26, 2022 | London
11

!
But Kafka related? Yes!
3
3
https://spectralops.io/blog/misconfigured-kafdrop-puts-companies-apache-kafka-completely-exp...

!
They found it "all" ...
3
3
https://spectralops.io/blog/misconfigured-kafdrop-puts-companies-apache-kafka-completely-exp...

unhappy
@hpgrahsl | #KafkaSummit April 25-26, 2022 | London
14

Core Kafka
Security Mechanisms
@hpgrahsl | #KafkaSummit April 25-26, 2022 | London
15

Table Stakes ?
@hpgrahsl | #KafkaSummit April 25-26, 2022 | London
16

over-the-wire encryption
@hpgrahsl | #KafkaSummit April 25-26, 2022 | London
17

authentication
@hpgrahsl | #KafkaSummit April 25-26, 2022 | London
18

authorization
@hpgrahsl | #KafkaSummit April 25-26, 2022 | London
19

@hpgrahsl | #KafkaSummit April 25-26, 2022 | London
20

@hpgrahsl | #KafkaSummit April 25-26, 2022 | London
21

disturbing
@hpgrahsl | #KafkaSummit April 25-26, 2022 | London
22

@hpgrahsl | #KafkaSummit April 25-26, 2022 | London
23

Core Security
Necessary !
@hpgrahsl | #KafkaSummit April 25-26, 2022 | London
24

Core Security
Sufficient ?
@hpgrahsl | #KafkaSummit April 25-26, 2022 | London
25

@hpgrahsl | #KafkaSummit April 25-26, 2022 | London
26

@hpgrahsl | #KafkaSummit April 25-26, 2022 | London
27

@hpgrahsl | #KafkaSummit April 25-26, 2022 | London
28

?
in use by brokers
@hpgrahsl | #KafkaSummit April 25-26, 2022 | London
29

brokers
see everything ...
and so does
any legitimate
Kafka client
@hpgrahsl | #KafkaSummit April 25-26, 2022 | London
30

@hpgrahsl | #KafkaSummit April 25-26, 2022 | London
31

human promise
is NOT
technical promise
@hpgrahsl | #KafkaSummit April 25-26, 2022 | London
32

end-to-end
encryption
? ? ?
@hpgrahsl | #KafkaSummit April 25-26, 2022 | London
33

Community Project
Kryptonite for Kafka
@hpgrahsl | #KafkaSummit April 25-26, 2022 | London
34

client-side
field level
cryptography
@hpgrahsl | #KafkaSummit April 25-26, 2022 | London
35

Client-Side Cryptography
@hpgrahsl | #KafkaSummit April 25-26, 2022 | London
36

Client-Side Cryptography
@hpgrahsl | #KafkaSummit April 25-26, 2022 | London
37

Field Level Encryption
@hpgrahsl | #KafkaSummit April 25-26, 2022 | London
38

Field Level Encryption
@hpgrahsl | #KafkaSummit April 25-26, 2022 | London
39

Field Level Decryption
@hpgrahsl | #KafkaSummit April 25-26, 2022 | London
40

Field Level Decryption
@hpgrahsl | #KafkaSummit April 25-26, 2022 | London
41

Kafka Connect
Single Message
Transform
@hpgrahsl | #KafkaSummit April 25-26, 2022 | London
42

CSFLC with Source Connectors
@hpgrahsl | #KafkaSummit April 25-26, 2022 | London
43

CSFLC with Source Connectors
@hpgrahsl | #KafkaSummit April 25-26, 2022 | London
44

CSFLC with Source Connectors
@hpgrahsl | #KafkaSummit April 25-26, 2022 | London
45

CSFLC with Source Connectors
@hpgrahsl | #KafkaSummit April 25-26, 2022 | London
46

CSFLC with Sink Connectors
@hpgrahsl | #KafkaSummit April 25-26, 2022 | London
47

CSFLC with Sink Connectors
@hpgrahsl | #KafkaSummit April 25-26, 2022 | London
48

CSFLC with Sink Connectors
@hpgrahsl | #KafkaSummit April 25-26, 2022 | London
49

CSFLC with Sink Connectors
@hpgrahsl | #KafkaSummit April 25-26, 2022 | London
50

@hpgrahsl | #KafkaSummit April 25-26, 2022 | London
51

Demo Scenario 1
@hpgrahsl | #KafkaSummit April 25-26, 2022 | London
52

@hpgrahsl | #KafkaSummit April 25-26, 2022 | London
53

@hpgrahsl | #KafkaSummit April 25-26, 2022 | London
54

@hpgrahsl | #KafkaSummit April 25-26, 2022 | London
55

@hpgrahsl | #KafkaSummit April 25-26, 2022 | London
56

@hpgrahsl | #KafkaSummit April 25-26, 2022 | London
57

@hpgrahsl | #KafkaSummit April 25-26, 2022 | London
58

Demo Scenario 2
@hpgrahsl | #KafkaSummit April 25-26, 2022 | London
59

@hpgrahsl | #KafkaSummit April 25-26, 2022 | London
60

@hpgrahsl | #KafkaSummit April 25-26, 2022 | London
61

@hpgrahsl | #KafkaSummit April 25-26, 2022 | London
62

@hpgrahsl | #KafkaSummit April 25-26, 2022 | London
63

@hpgrahsl | #KafkaSummit April 25-26, 2022 | London
64

@hpgrahsl | #KafkaSummit April 25-26, 2022 | London
65

Behind the Curtain ?
@hpgrahsl | #KafkaSummit April 25-26, 2022 | London
66

Cryptography
• Tink by Google
• AEAD based on AES GCM
• DAEAD based on AES SIV
• key rotation support
@hpgrahsl | #KafkaSu...

Keyset
Management
• within SMT config (not recommended)
• externalized to separate file (okayish)
• remote / cloud KMS (re...

!
Little Ideas
!
• wildcard / regex matching for field names
• dynamic keyset selection based on payload
• additional KMS ...

!
Bigger Ideas
!
• add further cryptography options (e.g. FPE)
• language / runtime agnostic data serialization
• extend s...

data should continue
to be a valuable
asset not become
a costly liability
@hpgrahsl | #KafkaSummit April 25-26, 2022 | Lon...

twitter
@hpgrahsl
@hpgrahsl | #KafkaSummit April 25-26, 2022 | London
72

Wanna try this?
• Project Code
https://bit.ly/ks22-ldn-k4k
• Demo Scenarios
https://bit.ly/ks22-ldn-demo
@hpgrahsl | #Kafk...

@hpgrahsl | #KafkaSummit April 25-26, 2022 | London

Share Slideshare

LinkedIn
Facebook
Twitter

Embed

Size (px)

Show related Slideshows at end

WordPress Shortcode

Link

Share
Email

2024 Trend Updates: What Really Wor... by Search Engine Jou... 1060498 views
Storytelling For The Web: Integrate... by Chiara Aliotta 978090 views
Artificial Intelligence, Data and C... by OECD Directorate ... 916989 views
How to Leverage AI to Boost Employe... by SocialHRCamp 389109 views
2024 State of Marketing Report – by... by Marius Sescu 220145 views
Everything You Need To Know About C... by Expeed Software 236739 views

View on Slideshare

1 of 74 Ad

View on Slideshare

1 of 74 Ad