Microservices - a security Nightmare?

http://gotocon.com/berlin-2015/presentation/Microservices%20-%20A%20Security%20Nightmare?

container-solutions.com

• attack surface bigger for micro-services
• more apps
• different technologies
• how to keep track of vulnerabilities
• internal APIs are exposed over the network
• security gates
• security testing
• fits well for waterfall
• how to do thread modeling and risk assessment in CD?
• DevOps vs. Specialists
• Containers: breakouts possible
• Microservice system:
• breaches are limited
• only the data they need (need to know principle)
• allows distribution among different network zones
• AWS: different VPCs for different Teams
• You can secure microservices with SSO
• openId
• SAML
• OpenIdConnect
• ID Tokens
• it's good if receiving services can verify the signature by themselves
• oauth2
• The confused Deputy
• API Gateways can be useful for
• access control
• rate limiting
• https termination
• Use WAF only for security critical services
• the "zoo" of technologies
• reduces the risk of one vulnerability compromising the whole system
• Security in an agile microservice world
• Trust the teams, they need:
• Accountability
• Expertise
• Support
• Softwarecraftsmanship
• Security should be part of the DOD
• "Baked into" the software
• ruggedsoftware.org
  • https://www.ruggedsoftware.org/wp-content/uploads/2013/11/Rugged-Handbook-v7.pdf
  • https://www.ruggedsoftware.org/wp-content/uploads/2013/11/Rugged-Implementation-Guide-v4.pdf
• Important: Mindset and Tooling for "SecOps"
• Tooling for devs is missing
• hardened base images
• integration in security logging
• Continous delivery
• Most important security Feature
• quick bugfixes
• use automated security checks (check slides!)
• continuumsecurity.net/bdd-intro
• run services of different security levels on different hosts
• tinyurl.com/docker-security
  • https://gallery.mailchimp.com/979c70339150d05eec1531104/files/Docker_Security_Red_Hat.pdf
  • run container in read-only-mode
  • minimal base images
  • drop capabilities
  • verify signed images
  • Hardening: AppArmor, SELinux
• Scan images for vulnerabilities
• Nautilus
• Clair
• Twistlock
• Scalock
• Secure deployments
• TLS, authentication, Authorization, Loggin & Auditing
• Summary
• see slides

have a look

• HMAC
• ruggedsoftware.org

• tinyurl.com/docker-security
• http://kubernetes.io

Thoughts:

• oauth Service is a bottleneck
  • we should enable clients to check token by themselves
• bei uns mal angehen:
  • Security should be part of the DOD
  • run services of different security levels on different hosts

ToDos

• Tim Steffens Talk to PI Team (image scans, docker-security )
• Tim Steffens Talk to Peter (image scans, docker-security, rugged software, docker security Buch, ggf. Typ vom Talk als Berater)
  
• Tim Steffens Check for slides!