Abstract:
Apache Kafka offers several security features ranging from authentication and authorisation mechanisms to over-the-wire encryption. This notwithstanding, data encryption performed at the client-side, which leads to explicit data-at-rest protection in topics at the broker's side, can still be considered a blind spot.
After highlighting the main benefits for data-at-rest protection, this session discusses in-depth how to selectively encrypt and decrypt sensitive payload fields in the context of Apache Kafka Connect pipelines. In particular, Kryptonite is introduced which is an ecosystem community project written and open-sourced by the speaker in 2021.
During this talk, you will learn how to benefit from a configurable single message transformation that lets you perform encryption and decryption operations in Kafka Connect worker nodes without any custom code. Client-side cryptography makes your Kafka-based data integration scenarios more secure by safeguarding the most sensitive and precious data against any form of uncontrolled or illegal access once it hits the Apache Kafka brokers.
Recording:
https://www.youtube.com/watch?v=4FmbWir_abM
Code:
- Kryptonite for Kafka Project: https://github.com/hpgrahsl/kryptonite-for-kafka
- Demo Scenarios: https://github.com/hpgrahsl/vdlux22-k4k-demo
hpgrahsl
daiksy
yuya4
ogijun2018
javiergs
chatii
makomakok
furukawayasuto
coe401_
speed1313
uhooi
manfredsteyer
guvalif
iamctodd
jrom
maltzj
skipperchong
jonyablonski
garrettdimon
schacon
marcelosomers
gr2m
speakerdeck
lynnandtonic
smashingmag