Divide and conquer by the power of TLS

TLS, security, agile, startups, microservices and other buzzwords. All things happily coexist. How can we put in place such infrastructure?

Transcript

1. Divide and conquer by the power of TLS Sérgio Serrano @serranos Confraria de Segurança da Informação 2017
2. Motivation Secure communications in a microservices environment
3. Motivation Buzz-bingo compliant ™ Secure communications in a microservices environment
4. Microservices Previously… Source: "Space Odyssey 2001" by Arthur C. Clarke and Stanley Kubrick.
5. Microservices Currently… Source: http://www.wired.com/
6. Microservices Compromise of one component can damage the whole system Source: http://www.wired.com/
7. Compromise = Bad Microservices
8. Compromise = Bad Microservices Source: https://imgflip.com/
9. Microservices Currently… Source: http://telegraph.co.uk/
10. Microservices A system can have LOTS of microservices Netflix has >500 Source: https://www.slideshare.net/BruceWong3/the-case-for-chaos
11. How can we do it?
12. How can we do it? A Public Key Infrastructure (PKI) can help
13. How can we do it? Say WHAT???
14. How can we do it? PKIs and flexibility aren’t usually BFFs
15. Secure communications between systems Still, PKIs can help you to...
16. Secure communications between systems Secure communications between users Still, PKIs can help you to...
17. Secure communications between systems Secure communications between users Secure communications between users and systems Still, PKIs can help you to...
18. Convince everyone that’s a good idea The Security Guy - Certificates are amazing!
19. Convince everyone that’s a good idea The Security Guy - Certificates are amazing! - You get authentication!
20. Convince everyone that’s a good idea The Security Guy - Certificates are amazing! - You get authentication! - You get confidentiality!
21. Convince everyone that’s a good idea The Security Guy - Certificates are amazing! - You get authentication! - You get confidentiality! - You get integrity!
22. Convince everyone that’s a good idea The Security Guy - Certificates are amazing! - You get authentication! - You get confidentiality! - You get integrity! - You get...
23. Convince everyone that’s a good idea ... an empty room. Everybody just left...
24. Convince everyone that’s a good idea Or, maybe not. Maybe you get someone that used certs Someone with The Best™solution
25. - Say WHAT? Do you know how many systems I own?! - OK. Than let’s make them last for… say forever! The Solution... Source: http://www.rawstory.com/
26. Many systems, many certificates Challenges
27. Many systems, many certificates Certificate revocation is not a solved problem Challenges
28. Many systems, many certificates Certificate revocation is not a solved problem Revocation can become a nightmare Challenges
29. Many systems, many certificates Certificate revocation is not a solved problem Revocation can become a nightmare Pièce de résistance: OCSP + CRLs do not scale very well Challenges
30. The Solution! The Pragmatic Security Guy - Let’s sprinkle those Certificates with some automation magic
31. How? The usual way... On the shoulders of giants: CFSSL by Cloudflare (initial core of Let’s Encrypt) Lemur by Netflix
32. CFSSL Build your PKI solution
33. CFSSL Architecture No custom details, no hassle Profiles for each type of certificate: Server User Client machine API Hierarchical CA architecture by design CA core engine for the “let’s encrypt” initiative
34. CFSSL Architecture
35. CFSSL Architecture
36. CFSSL Architecture > TLS mutual auth
37. CFSSL Architecture > OCSP responder
38. CFSSL Architecture > TLS scanning
39. CFSSL Architecture > DB backend All Tables Table Certificates Table OCSP Responses
40. Configuration based No custom details, no hassle Profiles for each type of certificate: Server User Client machine JSON based
41. What can you do with it? Create certificates Revoke certificates Deploy certificates remotely Notify about certificates expiring OCSP responder service CRL automated creation
42. Command line
43. Security Secure communications Limits impact of system compromise Separation of privilege Enables fast shutdown
44. Scalability Scales horizontally Only state that exists is kept in the database - Certificates metadata and OCSP responses System can become tolerant to database failures
45. Automation Integrates with DevOps environments via: Command line REST API Language library Automation = Short-lived certificates are possible! Short-lived certificates = better security Short-lived certificates = revocation problems highly reduced
46. Demo