BETA - Securing microservices

•

9 likes•1,602 views

Sam Newman

This is an early version of my talk on microservices and application security.

Software

SECURING
MICROSERVICES
Berlin Microservices Meetup
October 2015

@samnewman
Sam Newman
Building
Microservices
DESIGNING FINE-GRAINED SYSTEMS

@samnewmanhttps://www.ﬂickr.com/photos/seattlemunicipalarchives/4058808950

@samnewmanhttps://www.ﬂickr.com/photos/theseanster93/485390997/

@samnewman
S/M TestsBuild Large Tests Production
Security? Security?

@samnewmanhttps://www.microsoft.com/en-us/sdl/

@samnewman
Prevention Detection
Response

@samnewman
Prevention Detection
ResponseRecovery

@samnewmanhttps://www.ﬂickr.com/photos/adulau/15680439035/

@samnewmanhttps://www.ﬂickr.com/photos/duanestorey/469163789/

@samnewman
https://www.schneier.com/paper-attacktrees-ddj-ft.html

@samnewman
Open Safe
Pick Lock Learn Combo Cut Open

@samnewman
Open Safe
Pick Lock Learn Combo Cut Open
Find Written
Combo
Get Combo from
the target

@samnewman
Open Safe
Pick Lock Learn Combo Cut Open
Find Written
Combo
Get Combo from
the target
Blackmail Threaten Bribe

@samnewman
Open Safe
Pick Lock Learn Combo Cut Open
Find Written
Combo
Get Combo from
the target
Blackmail Threaten Bribe
Impossible
Impossible Impossible
Possible
Possible
Possible

@samnewman
Catalog
service
Music
Web Shop
Recommend
service
Royalty
service
Mobile
app
Web
browsers
User
service

@samnewman
Catalog
service
Music
Web Shop
Recommend
service
Royalty
service
Mobile
app
Web
browsers
User
service
Transport Security

BENEFITS OF HTTPS?
▫︎Server guarantees!
18

BENEFITS OF HTTPS?
▫︎Server guarantees!
▫︎Payload not manipulated…
18

BENEFITS OF HTTPS?
▫︎Server guarantees!
▫︎Payload not manipulated…
▫︎…but no client guarantee and…
18

BENEFITS OF HTTPS?
▫︎Server guarantees!
▫︎Payload not manipulated…
▫︎…but no client guarantee and…
▫︎…certiﬁcates can be a pain
18

Catalog
service
Music
Web Shop
Recommend
service
Royalty
service
Mobile
app
Web
browsers
User
service

CLIENT-SIDE CERTIFICATES?
▫︎Client guarantees!
22

CLIENT-SIDE CERTIFICATES?
▫︎Client guarantees!
▫︎…but a PITA to manage….
22

@samnewman
http://techblog.netﬂix.com/2015/09/introducing-lemur.html

@samnewman
Catalog
service
Music
Web Shop
Recommend
service
Royalty
service
Mobile
app
Web
browsers
User
service
Web
browsers
Form AuthOAuth

@samnewman
Catalog
service
Music
Web Shop
Recommend
service
Royalty
service
Mobile
app
Web
browsers
User
service
User
service

@samnewman
http://www.banyanops.com/blog/analyzing-docker-hub/

@samnewman33
Prevention Detection
ResponseRecovery

@samnewman
https://www.qualys.com/research/top10/

@samnewman
Polyglot = more stuff to track!

@samnewman37
Catalog
service
Music
Web Shop
Recommend
service
Royalty
service
Mobile
app
Web
browsers
User
service

@samnewman37
Catalog
service
Music
Web Shop
Recommend
service
Royalty
service
Mobile
app
Web
browsers
User
service
PERIMITER SECURITY!

@samnewman
CC Attribution 2.0 Generic https://www.ﬂickr.com/photos/ﬂissphil/52158537/

@samnewman
http://www.extremetech.com/computing/190959-shellshock-a-deadly-new-vulnerability-that-could-lay-waste-to-the-internet

@samnewman42
Prevention Detection
ResponseRecovery

@samnewmanhttp://krebsonsecurity.com/tag/target-data-breach/

@samnewman4949
Prevention Detection
ResponseRecovery

@samnewman535353
Prevention Detection
ResponseRecovery

@samnewman
snewman@thoughtworks.com
THANKS!

What's hot

Deploying and Scaling MicroservicesSam Newman

Practical microservices - NDC 2014Sam Newman

Principles of Microservices - NDC 2014Sam Newman

AppSec and MicroservicesSam Newman

It's a trap!Sam Newman

Testing & deploying microservices - XP Days Ukraine 2014Sam Newman

Hiding The Lead: Coupling, cohesion and microservicesSam Newman

Confusion In The Land Of The ServerlessSam Newman

Principles of microservices ndc osloSam Newman

From macro to micro gotoSam Newman

Rip It Up - The Microservice OrganisationSam Newman

THE UX OF DATA - VISUALIZATION RESPONSIVEPeter Rozek

Deploying and Testing MicroservicesThoughtworks

Networks, Networks Everywhere, And Not A Packet To DrinkReadWrite

Building better content creation with wysiwyg fields and custom formattersStuart Clark

The UX of DATA: Responsive Datenvisualisierung mit jQueryPeter Rozek

Cool Storytelling Tools Evelyn McCormack

Performance and UXPeter Rozek

Taking the P out of PWAChristian Heilmann

Rhys WynneRachel Bell

What's hot (20)

Deploying and Scaling Microservices

Practical microservices - NDC 2014

Principles of Microservices - NDC 2014

AppSec and Microservices

It's a trap!

Testing & deploying microservices - XP Days Ukraine 2014

Hiding The Lead: Coupling, cohesion and microservices

Confusion In The Land Of The Serverless

Principles of microservices ndc oslo

From macro to micro goto

Rip It Up - The Microservice Organisation

THE UX OF DATA - VISUALIZATION RESPONSIVE

Deploying and Testing Microservices

Networks, Networks Everywhere, And Not A Packet To Drink

Building better content creation with wysiwyg fields and custom formatters

The UX of DATA: Responsive Datenvisualisierung mit jQuery

Cool Storytelling Tools

Performance and UX

Taking the P out of PWA

Rhys Wynne

Similar to BETA - Securing microservices

Kim van Wilgen - Continuous security - Codemotion Rome 2019Codemotion

Continuous securityKim van Wilgen

Kim van Wilgen - Continuous security - Codemotion Amsterdam 2019Codemotion

Web/Azure Application Proxy : des apps, de la sécurité, partout !Microsoft Décideurs IT

Web/Azure Application Proxy : des apps, de la sécurité, partout !Microsoft Technet France

Testing & deploying Microservices GeeCon 2014Sam Newman

ALM for Developing Engineered Systems - Michael Azoff (Ovum) - 14 May 2019Intland Software GmbH

Continuous Security: Zap security bugs now Codemotion-2015Carlo Bonamico

Carlo Bonamico, Gabriele Guasco - Continuous Security: ZAP your security issu...Codemotion

PDF TESTB2BContact

KLEMEN on INNOVATION Webster 20150611 FINALMichael Klemen

Castle Walls Under Digital Siege: Risk-based Security for z/OSCA Technologies

Testing in the 21st CenturyAlex Soto

New Mainframe IT Analytics: Actionable Insight into Root Cause Analysis of Pe...CA Technologies

2015 positioning security & networkingAriel Evans

Deploying & operating microservicesThoughtworks

PPT TESTB2BContact

NOS Webinar: Reduce Security Risks to Protect Your Network FinalB2BContact

From mobile device policy to bring your own device (BYOD)Jisc

Redefining Contract Manufacturing Through the Use of RoboticsLora Cecere

Similar to BETA - Securing microservices (20)

Kim van Wilgen - Continuous security - Codemotion Rome 2019

Continuous security

Kim van Wilgen - Continuous security - Codemotion Amsterdam 2019

Web/Azure Application Proxy : des apps, de la sécurité, partout !

Testing & deploying Microservices GeeCon 2014

ALM for Developing Engineered Systems - Michael Azoff (Ovum) - 14 May 2019

Continuous Security: Zap security bugs now Codemotion-2015

Carlo Bonamico, Gabriele Guasco - Continuous Security: ZAP your security issu...

PDF TEST

KLEMEN on INNOVATION Webster 20150611 FINAL

Castle Walls Under Digital Siege: Risk-based Security for z/OS

Testing in the 21st Century

New Mainframe IT Analytics: Actionable Insight into Root Cause Analysis of Pe...

2015 positioning security & networking

Deploying & operating microservices

PPT TEST

NOS Webinar: Reduce Security Risks to Protect Your Network Final

From mobile device policy to bring your own device (BYOD)

Redefining Contract Manufacturing Through the Use of Robotics

Recently uploaded

Odoo 14 - eLearning Module In Odoo 14 Enterprisepreethippts

Cloud Data Center Network Construction - IEEEVICTOR MAESTRE RAMIREZ

SpotFlow: Tracking Method Calls and States at Runtimeandrehoraa

Intelligent Home Wi-Fi Solutions | ThinkPalmSujith Sukumaran

Alfresco TTL#157 - Troubleshooting Made Easy: Deciphering Alfresco mTLS Confi...Angel Borroy López

How to Track Employee Performance A Comprehensive Guide.pdfLivetecs LLC

办理学位证(UQ文凭证书)昆士兰大学毕业证成绩单原版一模一样umasea

Balasore Best It Company|| Top 10 IT Company || Balasore Software company Odishasmiwainfosol

Cyber security and its impact on E commercemanigoyal112

Recruitment Management Software Benefits (Infographic)Hr365.us smith

英国UN学位证,北安普顿大学毕业证书1:1制作qr0udbr0

GOING AOT WITH GRAALVM – DEVOXX GREECE.pdfAlina Yurenko

Best Web Development Agency- Idiosys USA.pdfIdiosysTechnologies1

Xen Safety Embedded OSS Summit April 2024 v4.pdfStefano Stabellini

PREDICTING RIVER WATER QUALITY ppt presentationvaddepallysandeep122

Tech Tuesday - Mastering Time Management Unlock the Power of OnePlan's Timesh...OnePlan Solutions

What is Advanced Excel and what are some best practices for designing and cre...Technogeeks

Alluxio Monthly Webinar | Cloud-Native Model Training on Distributed DataAlluxio, Inc.

Unveiling Design Patterns: A Visual Guide with UML DiagramsAhmed Mohamed

Hot Sexy call girls in Patel Nagar🔝 9953056974 🔝 escort Service9953056974 Low Rate Call Girls In Saket, Delhi NCR

Recently uploaded (20)

Odoo 14 - eLearning Module In Odoo 14 Enterprise

Cloud Data Center Network Construction - IEEE

SpotFlow: Tracking Method Calls and States at Runtime

Intelligent Home Wi-Fi Solutions | ThinkPalm

Alfresco TTL#157 - Troubleshooting Made Easy: Deciphering Alfresco mTLS Confi...

How to Track Employee Performance A Comprehensive Guide.pdf

办理学位证(UQ文凭证书)昆士兰大学毕业证成绩单原版一模一样

Balasore Best It Company|| Top 10 IT Company || Balasore Software company Odisha

Cyber security and its impact on E commerce

Recruitment Management Software Benefits (Infographic)

英国UN学位证,北安普顿大学毕业证书1:1制作

GOING AOT WITH GRAALVM – DEVOXX GREECE.pdf

Best Web Development Agency- Idiosys USA.pdf

Xen Safety Embedded OSS Summit April 2024 v4.pdf

PREDICTING RIVER WATER QUALITY ppt presentation

Tech Tuesday - Mastering Time Management Unlock the Power of OnePlan's Timesh...

What is Advanced Excel and what are some best practices for designing and cre...

Alluxio Monthly Webinar | Cloud-Native Model Training on Distributed Data

Unveiling Design Patterns: A Visual Guide with UML Diagrams

Hot Sexy call girls in Patel Nagar🔝 9953056974 🔝 escort Service