APPSEC AND MICROSERVICES Sam Newman GOTO Copenhagen 2016 @gotocph - PowerPoint PPT Presentation

APPSEC AND MICROSERVICES Sam Newman GOTO Copenhagen 2016

@gotocph @samnewman

@gotocph @samnewman https://www. fl ickr.com/photos/seattlemunicipalarchives/4058808950

@gotocph @samnewman https://www. fl ickr.com/photos/theseanster93/485390997/

http://map.norsecorp.com/ @gotocph @samnewman

@gotocph @samnewman

@gotocph @samnewman

Shipping Returns Customer Service Invoicing Accounts Inventory @gotocph @samnewman

Shipping Returns Small Autonomous services that work together , modelled Customer Service around a business domain Invoicing Accounts Inventory @gotocph @samnewman

https://www. fl ickr.com/photos/wwworks/2607036664/

https://www. fl ickr.com/photos/lkowen/15803718243/

@gotocph @samnewman

@gotocph @samnewman

@gotocph @samnewman

@gotocph @samnewman

@gotocph @samnewman

Prevention @gotocph @samnewman

Prevention Detection @gotocph @samnewman

Prevention Detection Response @gotocph @samnewman

Prevention Detection Recovery Response @gotocph @samnewman

Prevention Detection Recovery Response @gotocph @samnewman

Prevention Detection Recovery Response @gotocph @samnewman

@gotocph @samnewman https://www. fl ickr.com/photos/adulau/15680439035/

https://www. fl ickr.com/photos/duanestorey/469163789/ @gotocph @samnewman

https://www.schneier.com/paper-attacktrees-ddj-ft.html @gotocph @samnewman

Open Safe @gotocph @samnewman

Open Safe Pick Lock Learn Combo Cut Open @gotocph @samnewman

Open Safe Pick Lock Learn Combo Cut Open Find Written Get Combo from Combo the target @gotocph @samnewman

Open Safe Pick Lock Learn Combo Cut Open Find Written Get Combo from Combo the target Blackmail Threaten Bribe @gotocph @samnewman

Open Safe Pick Lock Learn Combo Cut Open Impossible Possible Find Written Get Combo from Combo the target Possible Blackmail Threaten Bribe Impossible Impossible Possible @gotocph @samnewman

Mobile Web app browsers Royalty Catalog Music Payment service Web Shop Gateway Recommend User service service @gotocph @samnewman

Mobile Web app browsers Royalty Catalog Music Payment service Web Shop Gateway Transport Security Recommend User service service @gotocph @samnewman

HTTPS Everywhere! @gotocph @samnewman

BENEFITS OF HTTPS?

BENEFITS OF HTTPS? ▫︎ Server guarantees!

BENEFITS OF HTTPS? ▫︎ Server guarantees! ▫︎ Payload not manipulated…

BENEFITS OF HTTPS? ▫︎ Server guarantees! ▫︎ Payload not manipulated… ▫︎ …but no client guarantee and…

BENEFITS OF HTTPS? ▫︎ Server guarantees! ▫︎ Payload not manipulated… ▫︎ …but no client guarantee and… ▫︎ …certi fi cates can be a pain

https://letsencrypt.org/ @gotocph @samnewman

@gotocph @samnewman

Mobile Web app browsers Royalty Catalog Music Payment service Web Shop Gateway Recommend User service service

CLIENT-SIDE CERTIFICATES?

CLIENT-SIDE CERTIFICATES? ▫︎ Client guarantees!

CLIENT-SIDE CERTIFICATES? ▫︎ Client guarantees! ▫︎ …but a PITA to manage….

http://techblog.net fl ix.com/2015/09/introducing-lemur.html @gotocph @samnewman

Mobile Web app browsers Royalty Catalog Music Payment service Web Shop Gateway Recommend User service service @gotocph @samnewman

Auth? @gotocph @samnewman

Mobile Web Web app browsers browsers OAuth Form Auth Royalty Catalog Music Payment service Web Shop Gateway Recommend User service service @gotocph @samnewman

Mobile Web Web app browsers browsers OAuth Form Auth Royalty Catalog Music Payment service Web Shop Gateway Recommend User User service service service @gotocph @samnewman

Mobile Web Web app browsers browsers OAuth Form Auth Royalty Catalog Music Payment service Web Shop Gateway Recommend User User service service service @gotocph @samnewman

Confused Deputy Problem! @gotocph @samnewman

Data At Rest? @gotocph @samnewman

Mobile Web app browsers Royalty Catalog Music Payment service Web Shop Gateway Recommend User User service service service @gotocph @samnewman

Aside: Docker @gotocph @samnewman

http://www.banyanops.com/blog/analyzing-docker-hub/ @gotocph @samnewman

Security? Security? Build S/M Tests Large Tests Production @gotocph @samnewman

Security? Security? Build S/M Tests Large Tests Production @gotocph @samnewman

https://www.microsoft.com/en-us/sdl/ @gotocph @samnewman

Patch Your Stu ff @gotocph @samnewman

Prevention Detection Recovery Response @gotocph @samnewman

Prevention Detection Recovery Response @gotocph @samnewman

https://www.qualys.com/research/top10/ @gotocph @samnewman

http://www.extremetech.com/computing/190959-shellshock-a-deadly-new-vulnerability-that-could-lay-waste-to-the-internet @gotocph @samnewman

@gotocph @samnewman

https://www.modsecurity.org/ @gotocph @samnewman

Mobile Web app browsers Catalog Music Royalty service Web Shop service Recommend User service service @gotocph @samnewman

Mobile Web app browsers PERIMETER SECURITY! Catalog Music Royalty service Web Shop service Recommend User service service @gotocph @samnewman

Polyglot = more stu ff to track! @gotocph @samnewman

Polyglot = more things to break? @gotocph @samnewman

Prevention Detection Recovery Response @gotocph @samnewman

Prevention Detection Recovery Response @gotocph @samnewman

@gotocph @samnewman

@gotocph @samnewman

@gotocph @samnewman

http://krebsonsecurity.com/tag/target-data-breach/ @gotocph @samnewman

Comms @gotocph @samnewman

Show teams with direct connection to users… Then show ‘backend services’ team Uni fi ed comms are needed! @gotocph @samnewman

@gotocph @samnewman

@gotocph @samnewman

https://en.wikipedia.org/wiki/Chicago_Tylenol_murders @gotocph @samnewman

http://www.smh.com.au/digital-life/mobiles/telstra-outage-manager-connected-customers-to-faulty-node-in-embarrassing- error-20160209-gmpn7f.html @gotocph @samnewman

"[The employee responsible] didn't follow procedures and clearly that's not a good thing but I wouldn't want to pre-empt the proper investigation and we'll figure out what the right response is when we've had a chance to dig into the detail." - Australian Financial Review http://www.afr.com/business/telecommunications/telstra-mobile-network-down-across- australia-reports-20160209-gmpaty @gotocph @samnewman

https://vimeo.com/102167635 @gotocph @samnewman

“Finding the root cause of a failure is like finding a root cause of a success.” John Allspaw http://www.kitchensoap.com/2012/02/10/each-necessary-but-only-jointly-su ffi cient/ @gotocph @samnewman

http://www.smh.com.au/technology/technology-news/telstra-free-data-guy-clocks-up-almost- a-terabyte-of-downloads-20160404-gnxu14.html @gotocph @samnewman

Prevention Detection Recovery Response @gotocph @samnewman

Prevention Detection Recovery Response @gotocph @samnewman

Backups @gotocph @samnewman

Backups Burn it all down @gotocph @samnewman

Backups Burn it all down Harder with microservices? @gotocph @samnewman

Review your old post-mortems @gotocph @samnewman

Review your old post-mortems …and the resulting action plans! @gotocph @samnewman

Prevention Detection Recovery Response @gotocph @samnewman

Building Microservices DESIGNING FINE - GRAINED SYSTEMS Sam Newman http://buildingmicroservices.com/ @gotocph @samnewman

Building Microservices DESIGNING FINE - GRAINED SYSTEMS Sam Newman http://buildingmicroservices.com/ http://samnewman.io/ @gotocph @samnewman

Building Microservices DESIGNING FINE - GRAINED SYSTEMS Sam Newman http://buildingmicroservices.com/ http://samnewman.io/ http://magpietalkshow.com/ @gotocph @samnewman