Upgrade to Pro
— share decks privately, control downloads, hide ads and more …
Speaker Deck
Features
Speaker Deck
PRO
Sign in
Sign up for free
Search
Search
Leoswaldo Macias - Protecting your App in the ...
Search
DevOpsDays GDL
February 21, 2020
Technology
0
340
Leoswaldo Macias - Protecting your App in the Cloud
DevOps Days GDL 2020 - February 20th
DevOpsDays GDL
February 21, 2020
Tweet
Share
More Decks by DevOpsDays GDL
See All by DevOpsDays GDL
Julian Limon - Aligned autonomy: How clarity on outcomes gets us to self-organized teams that win
devopsdaysgdl
0
540
Jorge Castro - Building DevOps Ways of Working at large Enterprise through learning, collaboration and Gamification experiences: Continuous WoWs, DevUps and Feedback
devopsdaysgdl
0
370
Salvador Elizarraras - Five Ways to Improve Team Performance
devopsdaysgdl
0
250
Tommy Adams - Cutting the Cord: Letting Your Remote Team Run Free
devopsdaysgdl
0
250
Cameron Motevasselani - Extending Spinnaker for the Enterprise
devopsdaysgdl
0
320
Jesus Contreras - Containers y DevTools en AWS
devopsdaysgdl
0
310
Liz fong-Jones - Production Excellence
devopsdaysgdl
0
350
Mofizur Rahman - Knative: Serverless Computing on Kubernetes
devopsdaysgdl
0
360
Ra Acosta - SAFe Journey 5.0
devopsdaysgdl
0
260
Other Decks in Technology
See All in Technology
allow_retry と Arel.sql / allow_retry and Arel.sql
euglena1215
1
150
スプリントレトロスペクティブはチーム観察の宝庫? 〜チームの衝突レベルに合わせたアプローチ仮説!〜
electricsatie
1
150
AWSで推進するデータマネジメント
kawanago
0
880
AI時代にPdMとPMMはどう連携すべきか / PdM–PMM-collaboration-in-AI-era
rakus_dev
0
260
AIのグローバルトレンド2025 #scrummikawa / global ai trend
kyonmm
PRO
1
150
TypeScript入門
recruitengineers
PRO
35
11k
RSCの時代にReactとフレームワークの境界を探る
uhyo
9
2.2k
JuniorからSeniorまで: DevOpsエンジニアの成長ロードマップ
yuriemori
2
350
Kubernetes における cgroup driver のしくみ: runwasi の bugfix より
z63d
2
120
絶対に失敗できないキャンペーンページの高速かつ安全な開発、WINTICKET × microCMS の開発事例
microcms
0
360
Vault meets Kubernetes
mochizuki875
0
170
なぜSaaSがMCPサーバーをサービス提供するのか?
sansantech
PRO
6
1.8k
Featured
See All Featured
Java REST API Framework Comparison - PWX 2021
mraible
33
8.8k
Mobile First: as difficult as doing things right
swwweet
224
9.9k
Keith and Marios Guide to Fast Websites
keithpitt
411
22k
Music & Morning Musume
bryan
46
6.8k
The Illustrated Children's Guide to Kubernetes
chrisshort
48
50k
How To Stay Up To Date on Web Technology
chriscoyier
790
250k
Documentation Writing (for coders)
carmenintech
73
5k
Art, The Web, and Tiny UX
lynnandtonic
302
21k
Practical Orchestrator
shlominoach
190
11k
Why Our Code Smells
bkeepers
PRO
339
57k
The Cost Of JavaScript in 2023
addyosmani
53
8.9k
How to train your dragon (web standard)
notwaldorf
96
6.2k
Transcript
Protecting your App in the Cloud @LeoswaldoMacias
Misconception
Shared Responsibility Model
“If you have access to change it then it is
yours, if not, then it’s theirs”
Incident Prevention A process to set instruments/tools/services to avoid possible
threats or impacts during an attack Incident Response Plan What to do when once we are impacted
Compliance Updates Maintain your instances up to date (OS, Libraries)
Network Does this need to be public accessible? What ports should I let in? What traffic should go out? Encryption At rest In transit Secret Management Keep your secret data secret
Network: Content Delivery Network CDN Content Delivery Network Your App
WAF
Network: Web Application Firewalls Firewall Layer 3 and 4 WAF
Contains Layer 7 attacks by inspecting for: • SQL Injections • XSS • Origin Geographically requests • String appearances • … and more
At least you know How soon or late? What are
the actions taken?
Incident Response Plan • Preparation • Detection • Containment •
Investigation • Recovery • Lesson Learn
Preparation Log everything you can (this will also help for
auditing) • Application Logs • Server Logs • Network Logs (Traces) • Access Logs and more Design the infrastructure to prevent single point of failure
Detection Monitoring and Alerting • Behaviour rules like traffic spikes,
CPU and Memory consumption • Traffic from countries not served • Sign in failures Page System :(
Containment Use automated processes to isolate any further impact like:
• Creating Network rules Make sure the impacted surface does not grow
Investigation • Analyze logs and timelines • Check which alarming
systems triggered • Check Dashboards
Recovery Get your environment to normal state
Lessons Learned Make sure all missings are documented and ARs
are assigned and tracked
Take Away #1 All applications are subject to exploits
Take Away #2 I’d rather invest more money on security
checks, tools, automation, than risking customer/company data
Take Away #3 Security is a shared responsibility to be
carried among all company employees, not only the Security crew
Thanks! @LeoswaldoMacias
[email protected]