GDG Google Cloud Security Next Ext 19

Multi-party approvals
IAM recommender
RBAC recommender
Cloud Identity
Workload Identity on GKE
GKE Sandbox Beta - gvisor.dev
Container Analysis GA
Binary Authorization GA
Managed TLS certificates

Transcript

1. Google Next Extended
3. Jonathan Pulsifer • Staff Infrastructure Security Engineer at Shopify, Kubernetes Product Security Committee Associate, and Google Developer Expert for Google Cloud Platform • Previously a SIGINT Cyber Sailor from the Canadian Forces Network Operations Centre and SANS Instructor • @jonpulsifer on the internet
4. Logging & Monitoring Cloud Security Command Center, Stackdriver, Logs, Forseti Control Plane VPC Service Controls, Shared VPC, Firewalls, Org Policies Access Path Cloud Identity, IAM, IAP, Context Aware Access, Security Keys, Built-in Infrastructure Security Data Path Default Encryption (Rest/Transit), KMS/CMEK/HSM, DLP, Dedicated Interconnect, Cloud Armor, Built-in Infrastructure Security The GCP Security Ecosystem On-Premises Apps Internet-Facing Apps Cloud Armor Dedicated Interconnect IAP Shared VPCs VPC Service Controls Cloud Security Command Center Firewall Cloud NAT IAM Org Policies DLP CSS Forseti Audit Logs Firewall Logs Stackdriver Sync VPC Flow Logs Stackdriver Monitoring BigQuery KMS/CMEK/HSM New for 2019 - Stuff N Things Built-in Infrastructure Security Context Aware/SK Identities Partners Cloud Identity
5. @jonpulsifer’s favourite announcements 01 Workload Identity on GKE 1. Service Accounts are hard 2. tl;dr enables OIDC provider for GKE clusters 3. Bridges the GCP project and Kubernetes PKI 4. Is awesome :) 02 Policy and IAM • Multi-party approvals • IAM recommender • RBAC recommender • Cloud Identity ◦ FINALLY ◦ LDAP all the things 03 Container Security 1. GKE Sandbox Beta - gvisor.dev 2. Container Analysis GA 3. Binary Authorization GA 4. Managed TLS certificates
6. The Shopify platform includes more than 50 GKE clusters used to power over 800,000 businesses in approximately 175 countries and is trusted by brands such as Unilever, Kylie Cosmetics, Allbirds, MVMT, and many more ServicesDB Create Service Generate PR Approve and merge Create Features Container Registry Push Pull kubernetes-deploy CloudBuddies (Kubernetes controllers) Create custom resource or deployments Watch for custom resource API calls Google Cloud Platform Other GCP services Ground Control (service robot) Webhook Cloud IAM Creates namespace and secrets Shopify Build
7. Emily Ye to Ground Control...
8. Ground Control to Emily Ye...
9. Ground Control to developers... 1. Initializes Kubernetes namespace inside a cluster 2. Generates encrypted JSON (ejson) keypair 3. Creates GCP service account identity and stores it in a Kubernetes secret
10. Keeping the cloud fluffy at Shopify NetPolbuddy Ensures Kubernetes network policy objects are in place RBACbuddy Ensures our Kubernetes RBAC policies are applied and up to date Bucketbuddy Provisions GCS buckets and manages their IAM permissions Accountabilibuddy Grants IAM bindings for GCP service accounts and stores them in a ConfigMap Illustrations by David Neal @reverentgeek
11. The Shopify platform includes more than 50 GKE clusters used to power over 800,000 businesses in approximately 175 countries and is trusted by brands such as Unilever, Kylie Cosmetics, Allbirds, MVMT, and many more ServicesDB Create Service Generate PR Approve and merge Create Features Container Registry Push Pull kubernetes-deploy CloudBuddies (Kubernetes controllers) Create custom resource or deployments Watch for custom resource API calls Google Cloud Platform Other GCP services Ground Control (service robot) Webhook Cloud IAM Creates namespace and secrets Shopify Build
12. Demystifying Google Service Accounts (GSA) 01 Two types of service accounts 1. Google managed GSAs are created and managed by Google and assigned to your project automagically 2. User-managed GSAs include new service accounts and the Compute Engine default service account 02 Keys are not well understood • Contains a security thingy • Documentation says do this: env: - name: GOOGLE_APPLICATION_CREDENTIALS value: /path/to/creds.json • It works! Thanks! shopifam [1:05 PM] left #help-infrasec 03 Keys are unreasonably hard to manage You need these processes: 1. Experience managing a PKI 2. Key storage 3. Key distribution 4. Key revocation 5. Key rotation 6. Protecting the keys from unauthorized users 7. Key recovery 8. … 9.
13. This stuff isn’t easy. 1. User managed GSA credentials live forever ◦ 10 years is forever in cloud years ▪ Who has the keys? ◦ Is actually 2048 bit RSA key pair ▪ CN=uniqueId 2. 1,000 GSAs per project ◦ Who would ever do that? ▪ We DoS IAM :(
14. Thanks!