Recommended
More Related Content
What's hot
What's hot (20)
Similar to Preventing Data Breaches: How to Tighten Your Security Stance
Similar to Preventing Data Breaches: How to Tighten Your Security Stance (20)
Recently uploaded
Recently uploaded (20)
Preventing Data Breaches: How to Tighten Your Security Stance
- 1. 1 Preventing Data Breaches A Tour on Tightening Your Security Stance
- 2. Becca Petrin She/Her Software Engineer Github: tyrannosaurus-becks 2
- 3. • Overview of Data Breaches • Hands-On • Getting data through…. • Common approaches • A platform-specific secrets manager • A cross-platform secrets manager • A dynamic secrets manager • Password-less authentication 3 Today’s Topics
- 4. • Imagining a Security Incident • Preventing Insider Breaches • Questions 4 Today’s Topics
- 5. Overview of Data Breaches 5
- 6. A History The Breach • 2013: Edward Snowden • 2014: Home Depot • 2017: Equifax • 2018: Facebook • 2019: Capital One 6 The Root Cause • An insider • Malware • Hackers • Hackers • Insider at AWS
- 10. Employee Fraud & Abuse Costs 5% per Year 10
- 12. • Make passwords hard to get • Then make passwords die • Then make passwords impossible to get • Then figure it out if there’s a data breach happening anyways 12 Let’s Prevent Some Breaches
- 13. 15
- 14. 16
- 15. 17
- 16. 18
- 17. Common Approaches Pros • Easy • Cheap up front • Instant access to passwords 19 Cons • Too easy • If breached, cost savings will be lost • No tracking who’s viewed things • Service must be offlined for password rotation • Password leak means many instances and services offlined for password rotation
- 19. • Cloudwatch - woo! • But what if the password was leaked? 21 Observability
- 20. A Platform-Specific Secrets Manager Pros • Easy-ish • Can use built-in identity • Some automated password rotation • More auditable • Pay-as-you-go 22 Cons • Another company has your secrets • Password rotation isn’t easy • Pay-as-you-go
- 22. import requests import json from psycopg2 import connect vault = 'ec2-54-197-74-45.compute-1.amazonaws.com' as_json = json.dumps({"password": "v7vf-swbiUYqB7MVzzMQ"}) response = requests.post("http://" + vault + ":8080/v1/auth/userpass/login/student", data=as_json) resp_json = json.loads(response.content) token = resp_json[‘auth']['client_token'] response = requests.get("http://" + vault + “:8080/v1/datadogdash/postgres_creds", headers={'X-Vault-Token': token}) resp_json = json.loads(response.content) password = resp_json['data']['password'] conn = connect('host=ec2-3-89-155-20.compute-1.amazonaws.com port=5432 dbname=dash user=student password=‘ + password) cur = conn.cursor() cur.execute("SELECT name FROM users WHERE ID=8364;") cur.fetchone() 24 Updating Our Code
- 23. • Application logs • Audit logs • >100 performance-oriented metrics 25 Observability
- 24. A Cross-Platform Secrets Manager Pros • Cross-platform • Can still use built-in identity • Secrets only inside your company • Encryption-as-a-service 26 Cons • Self deploy • Can be more complex • Opaque pricing
- 28. 30 Web Worker 1 foo-username bar-password Web Worker 2 fizz-username buzz-password Web Worker 3 boom-username hiss-password
- 29. import requests import json from psycopg2 import connect vault = 'ec2-54-197-47-181.compute-1.amazonaws.com' as_json = json.dumps({"password": "personalpassword"}) response = requests.post("http://" + vault + ":8080/v1/auth/userpass/login/student", data=as_json) resp_json = json.loads(response.content) token = resp_json[‘auth']['client_token'] response = requests.get("http://" + vault + “:8080/v1/database/creds/my-role", headers={'X-Vault-Token': token}) resp_json = json.loads(response.content) username = resp_json['data']['username'] password = resp_json[‘data']['password'] print ‘username: ’ + username + “, password: ” + password # this changes every time you call the my-role endpoint! run this script twice! conn_str = 'host=ec2-34-229-136-247.compute-1.amazonaws.com port=8080 dbname=dash user=‘ + username + ' password=' + password conn = connect(conn_str) cur = conn.cursor() cur.execute("SELECT name FROM users WHERE ID=8364;") cur.fetchone() 31 Updating Our Code
- 30. • Application logs • Audit logs • >100 performance-oriented metrics • Identity system helps with attribution 32 Observability
- 31. Cross-Platform + Secret Rotation Pros • Easy automated password rotation • The main approach is ephemeral usernames and passwords 33 Cons • Attribution can be difficult • Modern logging frameworks log faster than a username and password can disappear
- 33. 35 Can I get some data please?
- 34. 36 Sure, if you can take the string “abcd”, hash it with your password, and tell me the correct result.
- 35. 37 Hm, “abcd” and “mypassword” hashed are “806839236b1e9ddb”.
- 38. 40 Can I get some data please?
- 39. 41 Sure, if you can take the string “abcd”, hash it with your password, and tell me the correct result.
- 40. 42 Yo, the database said to hash the pass with “abcd”, what’s the challenge response?
- 44. from approzium import AuthClient from approzium.psycopg2 import connect auth = AuthClient('54.160.35.66:8080', disable_tls=True) conn = connect('host=52.5.163.43 port=8080 dbname=dash user=student', authenticator=auth) cur = conn.cursor() cur.execute("SELECT name FROM users WHERE ID=8364;") cur.fetchone() 46 Updating Our Code
- 45. • Explicitly security-oriented logs • Identity logged at INFO level • Suspicious activity logged at WARN level • Explicitly security-oriented metrics • DOS • Fuzzing • Impersonation • Replay attacks • Sniffing 47 Observability
- 46. Password-less Authentication Pros • Can use built-in identity • Pick your secrets manager • The main approach is unleakable passwords • Security-oriented observability at the forefront • SDK • Free extra layer to add 48 Cons • Self deploy • Can be more complex • Dynamic secrets not yet supported
- 47. 49
- 48. Imagining a Security Incident 51
- 49. A History The Breach • 2013: Edward Snowden • 2014: Home Depot • 2017: Equifax • 2018: Facebook • 2019: Capital One 52 The Root Cause • An insider • Malware • Hackers • Hackers • Insider at AWS
- 50. Scenario: Hackers • Your company has a portal that people log into. • You run it using a framework like Apache Struts, the Spring framework, Django, React, etc. • A serious vulnerability is announced. • An unauthenticated remote attacker begins exploiting the vulnerability by executing malicious code on effected instances (or containers). • One of their first actions is planting a script on every instance (or container) that is executed every hour by a cron job, and all it does is call out to somewhere to get arbitrary code, and it executes it. • You install a patch or update to resolve the vulnerability. 53
- 51. Scenario: Hackers The hacker snoops around on your instance and finds a configuration file like this: APPROZIUM_URL=ec2-100-26-168-97.compute-1.amazonaws.com APPROZIUM_PORT=8080 PG_URL=ec2-34-229-136-247.compute-1.amazonaws.com PG_PORT=8080 PG_DB_NAME=dash PG_USER_NAME=student 54
- 53. from approzium import AuthClient from approzium.psycopg2 import connect auth = AuthClient('54.160.35.66:8080', disable_tls=True) conn = connect('host=52.5.163.43 port=8080 dbname=dash user=student', authenticator=auth) cur = conn.cursor() cur.execute("SELECT * FROM pg_catalog.pg_tables WHERE schemaname != 'pg_catalog' AND schemaname != ‘information_schema';") cur.execute("SELECT * FROM users;") cur.fetchone() 56 They Make Code Just Like Yours!!!
- 54. 57 Yo, the database said to hash the pass with “efgh”, what’s the challenge response? Yo, the database said to hash the pass with “ijkl”, what’s the challenge response?
- 55. INFO: verified arn:aws:sts::733164497221:assumed-role/RoleForEC2Instances/ i-04810e8b639073295 INFO: verified arn:aws:sts::733164497221:assumed-role/RoleForEC2Instances/ i-04810e8b639073295 58
- 56. 59
- 57. Preventing Insider Breaches 60 Preventing Insider Breaches
- 58. Strategies You Should • Provide a way for employees to share secret information securely • Consider giving short-lived passwords • Give the minimum access needed to perform a job • Set minimum password complexity levels • Include your whole organization • Encrypt data at rest 61
- 59. 62 Summary
- 60. 63 There is no silver bullet.
- 61. Defense in Depth Defense in depth is a concept used in Information security in which multiple layers of security controls (defense) are placed throughout an information technology (IT) system. Its intent is to provide redundancy in the event a security control fails or a vulnerability is exploited. 64
- 62. 65 Questions?