Solving trust issues at scale - AppSec California
•Download as PPTX, PDF•
1 like•548 views
The document discusses building an authorization system for microservices that developers find easy to use. It proposes using Envoy proxies and Open Policy Agent (OPA) to enforce least privilege access policies. OPA policies can be written and managed separately from code. Logging and testing tools are also discussed. The system aims to provide secure defaults, scale to many services, and minimize impact on development speed. An example demonstration of the system enforcing candy access policies is shown.
Recommended
More Related Content
What's hot
What's hot (20)
Similar to Solving trust issues at scale - AppSec California
Similar to Solving trust issues at scale - AppSec California (20)
More from Soluto
More from Soluto (20)
Recently uploaded
Recently uploaded (20)
Solving trust issues at scale - AppSec California
- 1. Solving Trust Issues At Scale Building an Authorization System that Devs Don’t Hate @omerlh AppSec California January 2020
- 2. @omerlh
- 3. @omerlh
- 4. @omerlh
- 6. Post-Mortem • Automatic Detection (GitGurdian) • Harden Authorization System • Better audit logs • Who used this token? • Who created it and why? @omerlh
- 14. One horse can take down our fort... @omerlh
- 15. Let’s talk about blast radius • One vulnerable service affects all the other • Ensuring all services are trust worthy is impossible • We must narrow the blast radius @omerlh
- 18. The Ideal System Least Privilege • Just the permissions required Secure by Default • Zero permissions by default Self Service • Minimize the impact on development speed Scale • Hundred of micro-services to manage @omerlh
- 19. @omerlh
- 21. High Level Overview AppIncoming request Collect decision logs Get bundlesPublish bundle Is Authorized? @omerlh
- 23. Envoy Proxy • A CNCF project • Authentication and Authorization filters • Run as side car on the pod • No code changes required @omerlh
- 25. @omerlh
- 26. @omerlh
- 27. @omerlh
- 28. @omerlh
- 29. Meet Open Policy Agent • An open source policy system • Author policies using Rego DSL • Built-in Envoy integration • A CNCF project @omerlh
- 32. @omerlh
- 33. @omerlh
- 34. @omerlh
- 35. @omerlh
- 36. @omerlh
- 37. Done? Least Privilege • Just the permissions required Secure by Default • Zero permissions by default Self Service • Minimize the impact on development speed Scale • Hundred of micro-services to manage @omerlh
- 38. Wait, all devs need to learn Rego? @omerlh
- 39. @omerlh
- 40. @omerlh
- 41. @omerlh
- 42. @omerlh
- 44. Mono repo? @omerlh Centralized Distributed Governing Easy Complex Access Request One place Multiple repos Service owner Policies separated from code Policies with code
- 47. Done? Least Privilege • Just the permissions required Secure by Default • Zero permissions by default Self Service • Minimize the impact on development speed Scale • Hundred of micro-services to manage @omerlh
- 49. @omerlh
- 50. @omerlh
- 51. @omerlh
- 52. @omerlh
- 53. @omerlh
- 54. @omerlh
- 55. @omerlh
- 56. @omerlh
- 57. What about logging? • OPA log each decision into decision logs • Can be used for debug and audit purposes • Support redacting for sensitive input • Collect with Fluentd/Loki @omerlh
- 58. @omerlh
- 59. Putting it all together AppIncoming request Collect decision logs Get bundlesPublish bundle Is Authorized? @omerlh
- 60. Done? Least Privilege • Just the permissions required Secure by Default • Zero permissions by default Self Service Minimize the impact on development speed Scale • Hundred of micro-services to manage @omerlh
- 62. @omerlh
- 63. @omerlh
- 65. A really complex system… AppIncoming request Collect decision logs Get bundlesPublish bundle Is Authorized? @omerlh
- 66. Testing in Production • Using Zap Operator • Inspect production traffic • Run passive checks • Waiting for the JWT Fuzzer @omerlh
- 67. @omerlh
- 68. Done? Least Privilege • Just the permissions required Secure by Default • Zero permissions by default Self Service Minimize the impact on development speed Scale • Hundred of micro-services to manage @omerlh
- 69. Not everything is perfect • OPA/Envoy running as side-car • Resource usage costs per pod • A bug in OPA/Envoy has serious implication @omerlh
- 70. How can I use it? • Fork the GitHub repo - https://github.com/omerlh/opa-demo • Follow the readme • Reach out with questions @omerlh
- 72. Post-Mortem • Automatic Detection • Harden Authorization System • Better audit logs @omerlh
- 73. Going Forward • Improved Visibility • More Complex Policies • Expend adoption @omerlh
- 77. @omerlh Enable Devs to Move Faster and Safer
- 79. Resources • OPA-Envoy integration • Envoy JWT authentication • GitHub demo repo • Zap Operator • Solving Trust Issues at Scale @omerlh
Editor's Notes
- I’m a builder, this is what I love doing and doing it from a really early age Doing it professionally for the last 8 years I’m from Israel, married etc Who else is a builder? This talk is for you!
- Today I’m working at Soluto, our missing is to help people with their technology My job is DevSecOps, or as I see it - helping the entire team to build a more secure software I’m achieving it via many approaches, including education, reviewing and threat modeling – but what I love the most is threat modeling