Scaling Security

This is a short talk given on the challenges and ideas for building secure software as your organization grows (people and technology). It doesn't give any in depth detail on actual security choices since the focus was more on the organizational challenges.

This talk was given at dotScale in Paris.

Transcript

1. Scaling Security
   GROW WITHOUT COMPROMISING SECURITY
   

   View Slide

2. 
   Scaling
   mitchellh
   

   View Slide

3. 
   Scaling
   mitchellh
   

   View Slide

4. 
   Scaling
   mitchellh
   Developer Operator Production
   

   View Slide

5. 
   DevOps
   mitchellh
   Developer
   Operator
   Production
   

   View Slide

6. 
   DevOps
   mitchellh
   Developer
   Operator
   Production
   Security?
   

   View Slide

7. 
   DevOps
   mitchellh
   Developer
   Operator
   Production
   Security?
   

   View Slide

8. 
   Scaling Anything
   mitchellh
   1. Do less
   2. Do it faster
   3. Do more in parallel
   

   View Slide

9. 
   Scaling Security
   How do you empower people 

   to build secure systems?
   mitchellh
   

   View Slide

10. 
    Empowering
    Security
    mitchellh
    

    View Slide

11. 
    Empowering Security
    • Developers: A powerful, idiomatic API
    • Operators: A pure-software solution that is easy to maintain
    and can run on commodity hardware
    • Security Engineers: Strict usage control, audit trails, 

    clear threat models
    mitchellh
    

    View Slide

12. Vault
    mitchellh
    

    View Slide

13. 
    Developers: An API for Security
    • HTTP (over TLS), JSON
    • Secret storage
    • Encryption services
    • Certificate creation and verification
    mitchellh
    

    View Slide

14. 
    Operators: Its Just Software
    • Pure software, no hardware requirement
    • Stateless (pluggable data stores)
    • Active/standby HA
    • Read-scalability with replication (enterprise)
    mitchellh
    

    View Slide

15. 
    Security Engineers: Fort Knox
    • N-Person Unseal
    • Audit trails
    • Access Control
    • Clearly defined threat model and architecture
    • Open Source, Audited, Compliance, feature support
    mitchellh
    

    View Slide

16. 
    Scaling 

    Security
    mitchellh
    

    View Slide

17. 
    Scaling Security
    mitchellh
    Developer
    Operator Production
    Security
    

    View Slide

18. 
    Scaling Security
    mitchellh
    Developer
    Operator
    Security
    Core Security, Requirements, Practices, Audits
    Infrastructure Security, Network Security
    Application Security, Data Security
    

    View Slide

19. 
    Scaling Security: Sec Engineer
    • Allowed behavior
    • Encryption algorithms
    • Key hierarchies, 

    rotation policies
    • Audit logs
    mitchellh
    Core Security, Requirements, Practices, Audits
    

    View Slide

20. 
    Infrastructure Security, Network Security
    Scaling Security: Ops
    • Network layout/config,
    routing tables, etc.
    • OS security, user accounts,
    file permissions, etc.
    • Infrastructure creation,
    change process
    mitchellh
    

    View Slide

21. 
    Application Security, Data Security
    Scaling Security: Dev
    • TLS connections
    • API auth/authz
    • Data encryption
    • Password request and usage
    mitchellh
    

    View Slide

22. 
    Scaling Security
    Trust but verify at every level
    mitchellh
    

    View Slide

23. Scaling Security
    GROW WITHOUT COMPROMISING SECURITY
    

    View Slide