Leoswaldo Macias - Protecting your App in the Cloud

DevOps Days GDL 2020 - February 20th

Transcript

1. Protecting your
   App in the Cloud
   @LeoswaldoMacias
   

   View Slide

2. Misconception
   

   View Slide

3. Shared Responsibility Model
   

   View Slide

4. “If you have access to change it then it is
   yours, if not, then it’s theirs”
   

   View Slide

5. Incident Prevention
   A process to set instruments/tools/services to avoid possible threats or
   impacts during an attack
   Incident Response Plan
   What to do when once we are impacted
   

   View Slide

6. Compliance Updates
   Maintain your instances up to date (OS, Libraries)
   Network
   Does this need to be public accessible?
   What ports should I let in?
   What traffic should go out?
   Encryption
   At rest
   In transit
   Secret Management
   Keep your secret data secret
   

   View Slide

7. Network: Content Delivery Network
   CDN
   Content Delivery Network
   Your App
   WAF
   

   View Slide

8. Network: Web Application Firewalls
   Firewall Layer 3 and 4
   WAF Contains Layer 7 attacks by inspecting for:
   ● SQL Injections
   ● XSS
   ● Origin Geographically requests
   ● String appearances
   ● … and more
   

   View Slide

9. At least you know
   How soon or late?
   What are the actions
   taken?
   

   View Slide

10. Incident Response Plan
    ● Preparation
    ● Detection
    ● Containment
    ● Investigation
    ● Recovery
    ● Lesson Learn
    

    View Slide

11. Preparation
    Log everything you can (this will
    also help for auditing)
    ● Application Logs
    ● Server Logs
    ● Network Logs (Traces)
    ● Access Logs and more
    Design the infrastructure to
    prevent single point of failure
    

    View Slide

12. Detection
    Monitoring and Alerting
    ● Behaviour rules like traffic spikes, CPU
    and Memory consumption
    ● Traffic from countries not served
    ● Sign in failures
    Page System :(
    

    View Slide

13. Containment
    Use automated processes to isolate any
    further impact like:
    ● Creating Network rules
    Make sure the impacted surface does
    not grow
    

    View Slide

14. Investigation
    ● Analyze logs and timelines
    ● Check which alarming systems triggered
    ● Check Dashboards
    

    View Slide

15. Recovery
    Get your environment to
    normal state
    

    View Slide

16. Lessons Learned
    Make sure all missings are documented and ARs are assigned
    and tracked
    

    View Slide

17. Take Away #1
    All applications are subject to exploits
    

    View Slide

18. Take Away #2
    I’d rather invest more money on security checks, tools,
    automation, than risking customer/company data
    

    View Slide

19. Take Away #3
    Security is a shared responsibility to be carried among
    all company employees, not only the Security crew
    

    View Slide

20. Thanks!
    @LeoswaldoMacias
    leoswaldo.mancilla@wizeline.com
    

    View Slide