Making Security Usable: Product Engineer Perspective

Making Security Usable: Product Engineer Perspective

This is a story of going through typical security challenges: how to build products that reliably deliver security guarantees, avoid typical pitfalls, and are usable in a predictable fashion by real users. It's a tale of balancing religious adherence to security practices with keeping customer's needs in mind at all time inside the development team; listening to the customers and observing actual behavior outside in the wild; and trying to make the best decisions to empower customers with easy tools for encrypting data in their apps securely and without pain.

We'll take a look at the process through the eyes of one of our customers, who made all the things wrong before doing things right, and through the eyes of product engineer, responsible for learning the lessons to make security products even more usable and reliable for non-security-focused engineers.

Key takeaways:

Attendees will go through several stages of inception and implementation of database encryption/intrusion detection tools. They will see the "behind the scenes" work inside a cryptographic engineering company, will see how customers are one of the most useful people to learn from, and how getting over "we tell you what to do" mentality makes security tools better.

042b7c0e45c53de46667f07de2fb2614?s=128

vixentael

June 29, 2018
Tweet

Transcript

  1. 28.

    @vixentael ? ..but how it should work ..and will it

    really be secure now? we want one tool that solves all problems..
  2. 40.
  3. 41.
  4. 47.

    @vixentael – real time analytics (user actions) – servers load

    – error logs – user testing / user research – open tickets / issues
  5. 48.

    @vixentael – real time analytics (user actions) – user testing

    / user research – servers load – open tickets / issues – error logs
  6. 53.

    Data Security Assistance Program @vixentael business model / regulations risks

    to data threat model / attack vectors data security scheme
  7. 61.

    @vixentael Deployment Multiple channels of distribution code built packages (.pkg)

    docker images VM images chef configuration docker compose
  8. 63.

    @vixentael Deployment 1. Download, build, install every component 2. Generate

    keys / tokens for each component 3. Put keys into right folders (PK exchange) 5. Run components using correct config 4. Configure each component (port, keys)
  9. 64.

    2. Generate keys / tokens for each component @vixentael Deployment

    1. Download, build, install every component 3. Put keys into right folders (PK exchange) 5. Run components using correct config 4. Configure each component (port, keys) script
  10. 65.

    @vixentael Deployment 1. Download, build, install every component 3. Put

    keys into right folders (PK exchange) 5. Run components using correct config 4. Configure each component (port, keys) 2. Generate keys / tokens for each component script
  11. 66.

    @vixentael Deployment 1. Download, build, install every component 3. Put

    keys into right folders (PK exchange) 5. Run components using correct config 4. Configure each component (port, keys) defaults 2. Generate keys / tokens for each component script
  12. 67.

    @vixentael Deployment 1. Download, build, install every component 3. Put

    keys into right folders (PK exchange) 5. Run components using correct config 4. Configure each component (port, keys) one command! 2. Generate keys / tokens for each component
  13. 70.

    @vixentael Deployment Pre-baked configurations mysql-ssl-server-ssl.yml MySQL <-SSL-> AServer <-SSL-> client

    pgsql-nossl-server-ssession-connector.yml PostgreSQL <-> AServer <-SecureSession-> AConnector <---> client ‘-> AWebconfig
  14. 72.

    @vixentael Deployment Integration tests everywhere – run on 12 OSs

    – run on empty environments – provide testing scripts for users
  15. 73.

    @vixentael Integration – logging formats (plaintext, json, CEF) – infrastructure

    as a code (configs everywhere) – event formats (unique event codes) Good products do not exist in a vacuum
  16. 78.

    API design from pythemis.scell import SCellSeal scell = SCellSeal(key) encrypted_message

    = scell.encrypt(message, context) message = scell.decrypt(encrypted_message, context) github.com/cossacklabs @vixentael
  17. 88.

    @vixentael Docs for developers integration scenarios security recommendations simple explanations

    benchmarks security model threat vectors schemes & formulas for security ppl
  18. 101.
  19. 102.

    Home reading? https://medium.com/@kshortridge/security-as-a-product-83a78c45ca27 Security as a Product https://github.com/forter/security-101-for-saas-startups/blob/english/security.md Organization security

    for startups https://2017.hack.lu/archive/2017/hacklu-crypto-api.pdf API design for cryptography https://cr.yp.to/talks/2015.10.05/slides-djb-20151005-a4.pdf Boring crypto, Daniel J. Bernstein