Securing Microservice Architectures

Slide 1

Slide 1 text

No content

Slide 2

Slide 2 text

Securing Microservice Architectures Laura Bell (@lady_nerd) M239

Slide 3

Slide 3 text

No content

Slide 4

Slide 4 text

Modern

Slide 5

Slide 5 text

caution: fast paced field ahead watch for out of date content

Slide 6

Slide 6 text

In this talk Microservice Fundamentals Some important points that are worth refreshing Prevention Avoid common vulnerabilities and avoid mistakes Detection Prepare for survival and response

Slide 7

Slide 7 text

No content

Slide 8

Slide 8 text

No content

Slide 9

Slide 9 text

No content

Slide 10

Slide 10 text

apps that automatically scale up to handle millions of users and scale down again to have this be done by smaller teams

Slide 11

Slide 11 text

many are 100 or so lines some are around 1,000 lines

Slide 12

Slide 12 text

Integrity Availability Conﬁden3ality

Slide 13

Slide 13 text

Spooﬁng Tampering Repudia1on Informa1on Disclosure Denial of Service Escala1on of Privilege

Slide 14

Slide 14 text

No content

Slide 15

Slide 15 text

Service decomposition

Slide 16

Slide 16 text

shouldn’t

Slide 17

Slide 17 text

No content

Slide 18

Slide 18 text

exhaustion

Slide 19

Slide 19 text

Orchestration layer attacks

Slide 20

Slide 20 text

simple

Slide 21

Slide 21 text

rule them all?

Slide 22

Slide 22 text

Choose Restrict Monitor Configure Challenge Test

Slide 23

Slide 23 text

Identity and access management

Slide 24

Slide 24 text

the lowest set of permissions and accesses required to do your job

Slide 25

Slide 25 text

require well defined roles

Slide 26

Slide 26 text

Automate and alert

Slide 27

Slide 27 text

mature groups and role assistance

Slide 28

Slide 28 text

Immutable architectures matter in microservice security

Slide 29

Slide 29 text

(but you might not be the right person to audit them)

Slide 30

Slide 30 text

(including those changes made by an attacker)

Slide 31

Slide 31 text

become hard to persist

Slide 32

Slide 32 text

Heterogeneous language and technology spaces

Slide 33

Slide 33 text

No content

Slide 34

Slide 34 text

you

Slide 35

Slide 35 text

technologies

Slide 36

Slide 36 text

vulnerability management can be challenging in microservice architectures

Slide 37

Slide 37 text

No content

Slide 38

Slide 38 text

Testing

Slide 39

Slide 39 text

(doesn’t require a specialist third party)

Slide 40

Slide 40 text

OWASP Zap Proxy https://www.owasp.org/index.php/OWASP_Zed_Attack_Proxy_Project Gauntlt http://gauntlt.org/ BDD Security http://www.continuumsecurity.net/bdd-intro.html

Slide 41

Slide 41 text

software testing technique discover coding errors security loopholes massive amounts of random data attempt to make it crash

Slide 42

Slide 42 text

No content

Slide 43

Slide 43 text

Logging and monitoring

Slide 44

Slide 44 text

All

Slide 45

Slide 45 text

secure location immutable format away from production

Slide 46

Slide 46 text

denial of service attacks

Slide 47

Slide 47 text

like actually, for real, not just when you’re debugging

Slide 48

Slide 48 text

No content

Slide 49

Slide 49 text

TL;DR Microservice Fundamentals Some important points that are worth refreshing Prevention Avoid common vulnerabilities and avoid mistakes Detection Prepare for survival and response

Slide 50

Slide 50 text

Security in a Container-based World Friday 11:55am Find me later at… §  Hub Happy Hour Wed 5:30-6:30pm §  Hub Happy Hour Thu 5:30-6:30pm §  Closing drinks Fri 3:00-4:30pm 1 2 3 4 5 6

Slide 51

Slide 51 text

Subscribe to our fortnightly newsletter http://aka.ms/technetnz http://aka.ms/msdnnz http://aka.ms/ch9nz Free Online Learning http://aka.ms/mva Sessions on Demand

Slide 52

Slide 52 text

No content

Slide 53

Slide 53 text

© 2015 Microsoft Corporation. All rights reserved. Microsoft, Windows and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.