Security

 Security

Presentation about some of the security measure Ravelin takes to protect our clients data.

33784c359ec2b861122ea834fd7e3f3b?s=128

Leonard Austin

March 17, 2017
Tweet

Transcript

  1. Security at Ravelin 2017 Leonard Austin | 2017-03-17 ravelin.com

  2. Summary Accreditation • Accreditation is important to increase clients’ trust

    • Accreditation IS NOT an assessment of security • Effective security is baked into everyday process and actually improves workflow • Security evolves and is everyone's responsibility PCI DSS ISO 27001 ravelin.com
  3. ravelin.com Cost of Security

  4. Financial The cost of licence fees, extra servers, new laptops

    etc. Relatively unimportant as we have insurance for laptops/hardware and we don’t own servers and cost for security products are cheap-ish (e.g. YubiKey). Cost of Security
  5. ravelin.com Cost of Security Time Pretty important factor. We are

    a start-up and time is probably our biggest constraint. Lots of competing priorities and security has to be prioritised along side other work.
  6. Cost of Security Friction Essentially, the level of annoyance genuine

    users have to go through to gain access. Too hard and humans will just circumvent because we are all lazy. This is super important. Good security has less friction. Note: don’t confuse friction with resistance to change (RTC). RTC should be completely ignored when deciding whether to implement security measures.
  7. ravelin.com Current Measures Attack/Defend/Cost

  8. Attack Vector Defensive Measure Cost (Time/Friction)(0-3) Key Loggers 2FA +

    1Password 1 + 1 Stolen Hardware Encrypted Disk 0 + 0 Stolen Home Dir (~/.* .ssh .aws .gcp etc) VPN + 2FA, Bastion, Limited Privileges, Password on keys 1 + 2 Stolen Physical Servers Encrypted Disk + Outsource Physical Security to Cloud Provider 0 + 0 Man in the middle Signed Certificate (TLS 1.2+) 1 + 0 Unauthorised Access to the Office No data stored in the office and treated as the internet 0 + 0 *Fraudulent Requests Trusted user via 3rd party auth - *Phishing 2FA TOTP (kind-of but not really) - Unauthorised DB Access Secrets stored inside a KMS - *Network Breach Single point of entry (VPN+Bastion) 0 + 2
  9. Attack Vector Defensive Measure Cost (Time/Friction)(0-3) Key Loggers 2FA +

    1Password 1 + 1 Stolen Hardware Encrypted Disk 0 + 0 Stolen Home Dir (~/.* .ssh .aws .gcp etc) VPN + 2FA, Bastion, Limited Privileges, Password on keys 1 + 2 Stolen Physical Servers Encrypted Disk + Outsource Physical Security to Cloud Provider 0 + 0 Man in the middle Signed Certificate (TLS 1.2+) 1 + 0 Unauthorised Access to the Office No data stored in the office and treated as the internet 0 + 0 *Fraudulent Requests Trusted user via 3rd party auth - *Phishing 2FA TOTP (kind-of but not really) - Unauthorised DB Access Secrets stored inside a KMS - *Network Breach Single point of entry (VPN+Bastion) 0 + 2
  10. ravelin.com 2017 More Security & Less Friction

  11. Security ravelin.com Phishing FIDO U2F Fraudulent Requests (Invoice/ACL) 2 Unique

    Channel Authorisation (TUCA) Unauthorised Data Access Secrets stored inside a KMS & Zero Trust Network Network Breach Remove SSH Keys New Machine Class: SECURE Hack Ravelin Day Internal resource to attempt to breach our own network and access data Zero Trust Network Sign Builds Encrypt all s2s comms TLS with signed certs
  12. Security Phishing Drill Results Phishing is the attempt to obtain

    sensitive information such as usernames, passwords, and credit card details (and, indirectly, money), often for malicious reasons, by disguising as a trustworthy entity in an electronic communication.
  13. Security Phishing - U2F Chrome/Firefox Only (iPhone users warning) You

    won’t be able to use your Google Account on your iPhone's Mail, Calendar, or Contact apps. Security Key doesn't work with apps that come on your iPhone, but you can use Google apps instead.
  14. E.g. 1. Requester messages via slack 2. Approver challenges with

    TUCA 3. Requester messages via (email, sms, in person, phone) 4. Approver actions request TUCA When Movement of money Username/password resets Anything ACL related ravelin.com Security Fraudulent Requests - TUCA Policy
  15. Unauthorised Data Access • GCP Key Management Service - not

    just for keys • Operational config stored securely (KMS) • Restrict access to KMS to only select machines • KMS Features a. Generate AES256 encryption keys b. Wrap secrets up to 64KiB in size c. Audit Logging enabled ravelin.com Security
  16. Security No SSH Keys with added Magic • No SSH

    keys • No VPN • No self signed certs • No OpenVPN registration • All the goodness of full fat access without the friction • Jump from bastion to internal network • Secured with U2F from the console dashboard • Port 22 blocked for the internet
  17. Attack Vector Defensive Measure Cost (Time/Friction)(0-3) Key Loggers U2F +

    1Password 1 + 1 Stolen Hardware Encrypted Disk 0 + 0 Stolen Home Dir (~/.* .ssh .aws .gcp etc) Console SSH to bastion (jump) then to internal network 1 + 1 Stolen Physical Servers Encrypted Disk + Outsource Physical Security to Cloud Provider 0 + 0 Man in the middle Signed Certificate (TLS 1.2+) 1 + 0 Unauthorised Access to the Office No data stored in the office and treated as the internet 0 + 0 Fraudulent Requests 2 Unique Channel Authorisation (TUCA) 0 + 1 Phishing U2F 1 + 1 Unauthorised DB Access Secrets stored inside a KMS & Zero Trust Network 2 + 0 Network Breach Console SSH & Zero Trust Network 3 + 0
  18. Zero Trust Network 2017 ravelin.com

  19. Encryption with Alice and Bob ravelin.com

  20. SSL ravelin.com

  21. About us Zero Trust • Sign Builds • Encrypt all

    service 2 service comms • TLS with signed certs • CA • Queue Data asymmetrically encrypted • Disable root access • New Machine Class of “SECURE” ◦ No SSH ◦ Only instance with KMS Access ◦ File integrity monitoring ◦ KMS Credentials stored in memory ◦ Manually bootstrapped ravelin.com
  22. Hack Ravelin Day Internal resource to attempt to access data

    from within our own zero trust network ravelin.com Security Roadmap
  23. Thank you Security, whoop ravelin.com