Netflix Cloud Security Overview

•

2 j'aime•1,160 vues

Amazon Web Services

by Will Bengtson, Netflix

RepoingIAMPermissions
OurstrategyforAWSLeastPrivilege
PatrickKelley
TravisMcPeak

Agenda
●Introandcontextsetting
●Approaches
●Aardvark&Repokid
●Futurework

●GeneralDynamics->eBay->Netflix
●Decenttrampolinejumper
●SecurityMonkey,CloudAux,Aardvark,Repokid
PatrickKelley

●Symantec->HP->IBM->Netflix
●OpenStackSecurity,CloudFoundrySecurity,OWASPBayArea
●Bandit,Recon,Aardvark,Repokid
TravisMcPeak

Netflix
LargeAWSdeployment
●100K+instances
●Thousandsofapplications
●Over50AWSaccounts
Mediumengineering
●~2000inproduct
●~50securityengineers

Netflix
Culturedrivesourdecisions,includingthiswork
●FreedomandResponsibility
●Context,notControl

LeastPrivilege
Onlygranttherequiredaccess
necessarytoperformlegitimate
functions.
SeemscontrarytoNetflixFreedomand
Responsibilityvalue.
Thetrickistobalance.

Developersrequestspecific
permissionstheyneedtodeployand
runtheirapp.
Soundsreasonable...

●86services*
●2318permissions*
●Hardtoknowbasedonname
●Whataboutdependencies?
●Hardtogetrightonfirst,second,thirdpass...
Developersdon’tknowwhattheyneed
*AccordingtoPolicyUniverse,updated5/31

Startwithnopermissions,add
incrementally

Havedevelopersaddtheirown
permissionswithself-service
model

●Appsgivenpermissionscommonlyusedduringdeployment
○Ifmoreneeded,wehaveaquickconversation
●Profiletherolecontinuously
●Takeawayunusedpermissions
●Deletetherolewhenit’snolongerused
(Mostly)automatedrolelifecycle

●DevelopersuseSpinnaker
●Spinnaker->Lambdawithinformation
abouttheapp
●Lambdacreatesaroleandgives
“base”permissions
○Basepermissionsdependon
typeofappandaccount.
Developerdeploysnewapp

●CurrentlyusingAccessAdvisor
○WilluseCloudTrailsoon
●Findoutwhichpermissionsanappisusing
●Watchdenied/AAforservicesthataren’tallowed
○Eithermisconfigurationorattack
Profilerolecontinuously

●Takeawaypermissionsthathaven’tbeenusedrecently
○Hasthesidebenefitthatunusedappslosepriv
●Storeoldversionofpolicysowecanrollbackifneeded
●Soon:automaticallyrollbackifCloudTrailshowsdenied
Repounusedpermissions

Attack!
●Alreadydemonstratedreal-worldbenefits
○Internaltesting
○Responsibledisclosureprogram
●Somestopped,somenot
○Wecan’trepopermissionstheappactuallyneeds!

●Unusedappswillalreadyhavebeenrepoedto0
●Finalstepistocleanuprolesthatarenolonger
attachedtoapplications
Deletetherolewhennolongerused

●RetrieveandcacheAccessAdvisordatafromthe
console
●Mostlyfeaturecomplete,plantoswitchtoAccess
AdvisorAPIwhenavailablefromAWS
Aardvark(NetflixOSS)

●Scanroles,lookforunusedpermissions,takethem
away,makeiteasytorollback
●Chat-opsintegration:what’sbeingrepoed,opt-out,
rollback
●LongtermstrategicforNetflixSecurity
○CloudTrailintegration
○Notificationsandreportstoappowner
Repokid(NetflixOSS)

●Newpermissionsshouldn’tgetrepoedforawhile
○Needtomakeiteasyfordeveloperstogetnewpermissions
Needtoconsider

●Newpermissionsshouldn’tgetrepoedforawhile
○Needtomakeiteasyfordeveloperstogetnewpermissions
●Whatshouldwedotopreserveinfrequentlyusedpermissions?
○Suchasthoseusedindisasterrecovery
Needtoconsider

UserepodatatotightenbaseIAM
FrequentlyrepoedservicesshouldnotbeincludedinbaseIAMinthefirstplace.
-Wecantolerateasmallpercentageofdevelopersrequestingadditionalaccess

Introspection
Examineapplicationsastheyarebeingdeployedandgivethempermissionsbasedon
whattheyneed.
Example:canseethat:
-AspecificDynamotableisused
-Theapplicationreadsfromaspecificqueue

Contenu connexe

Tendances

20210126 AWS Black Belt Online Seminar AWS CodeDeployAmazon Web Services Japan

AWS Shieldのご紹介 Managed DDoS ProtectionAmazon Web Services Japan

OAuth 2.0による認可の流れTakeshi Mikami

AWS Black Belt Techシリーズ AWS SDKAmazon Web Services Japan

AWS Security & ComplianceAmazon Web Services

20200128 AWS Black Belt Online Seminar Amazon ForecastAmazon Web Services Japan

AWS Black Belt Online Seminar AWS CloudFormation アップデートAmazon Web Services Japan

20명 규모의 팀에서 Vault 사용하기Doyoon Kim

Augmenting Security Posture and Improving Operational Health with AWS CloudTr...Amazon Web Services

(DVO308) Docker & ECS in Production: How We Migrated Our Infrastructure from ...Amazon Web Services

インターネットにおける動画配信の仕組みRyosuke Kubo

Operational Excellence with Containerized Workloads Using AWS Fargate (CON320...Amazon Web Services

20191112 AWS Black Belt Online Seminar AWS Media Services で始めるライブ動画配信Amazon Web Services Japan

Amazon VPC VPN接続設定参考資料Amazon Web Services Japan

20190312 AWS Black Belt Online Seminar AWS Well-Architected Frameworkによるコスト最適化Amazon Web Services Japan

AWS Elemental MediaConvert で動画変換虎の穴開発室

AWS Lambda ハンズオン 2-Tier アーキテクチャで未来へAmazon Web Services Japan

아마존웹서비스와 함께하는 클라우드 비용 최적화 전략 - 윤석찬 (AWS 코리아 테크에반젤리스트)Amazon Web Services Korea

Deep Dive on Amazon S3 Security and Management (E2471STG303-R1) - AWS re:Inve...Amazon Web Services

천만 사용자를 위한 AWS 아키텍처 보안 모범 사례 (윤석찬, 테크에반젤리스트)Amazon Web Services Korea

Tendances (20)

20210126 AWS Black Belt Online Seminar AWS CodeDeploy

AWS Shieldのご紹介 Managed DDoS Protection

OAuth 2.0による認可の流れ

AWS Black Belt Techシリーズ AWS SDK

AWS Security & Compliance

20200128 AWS Black Belt Online Seminar Amazon Forecast

AWS Black Belt Online Seminar AWS CloudFormation アップデート

20명 규모의 팀에서 Vault 사용하기

Augmenting Security Posture and Improving Operational Health with AWS CloudTr...

(DVO308) Docker & ECS in Production: How We Migrated Our Infrastructure from ...

インターネットにおける動画配信の仕組み

Operational Excellence with Containerized Workloads Using AWS Fargate (CON320...

20191112 AWS Black Belt Online Seminar AWS Media Services で始めるライブ動画配信

Amazon VPC VPN接続設定参考資料

20190312 AWS Black Belt Online Seminar AWS Well-Architected Frameworkによるコスト最適化

AWS Elemental MediaConvert で動画変換

AWS Lambda ハンズオン 2-Tier アーキテクチャで未来へ

아마존웹서비스와 함께하는 클라우드 비용 최적화 전략 - 윤석찬 (AWS 코리아 테크에반젤리스트)

Deep Dive on Amazon S3 Security and Management (E2471STG303-R1) - AWS re:Inve...

천만 사용자를 위한 AWS 아키텍처 보안 모범 사례 (윤석찬, 테크에반젤리스트)

En vedette

Netflix Cloud Security OverviewAmazon Web Services

Developing Applications with the IoT Button - AWS Online Tech TalksAmazon Web Services

A Tale of Security & Ops Teamwork for Rapid Security Incident ResolutionAmazon Web Services

Serverless for DevelopersAmazon Web Services

Digital Transformation with smart products - EVRYTHNGAmazon Web Services

Hands-on Lab: Amazon ElastiCacheAmazon Web Services

En vedette (6)

Netflix Cloud Security Overview

Developing Applications with the IoT Button - AWS Online Tech Talks

A Tale of Security & Ops Teamwork for Rapid Security Incident Resolution

Serverless for Developers

Digital Transformation with smart products - EVRYTHNG

Hands-on Lab: Amazon ElastiCache

Similaire à Netflix Cloud Security Overview

Instrument Rack to visualize  Rails requests processing Sqreen

DevOpsDays Taipei 2019 - Mastering IaC the DevOps Waysmalltown

Pipeline as code for your infrastructure as CodeKris Buytaert

Hardening Kubernetes ClusterKnoldus Inc.

Introducing CQ 5.1David Nuescheler

Containing Chaos with Kubernetes - Terrence Ryan, Google - DevOpsDays Tel Avi...DevOpsDays Tel Aviv

Creating pools of Virtual Machines - ApacheCon NA 2013Andrei Savu

Live traffic capture and replay in cassandra 4.0Vinay Kumar Chella

Infrastructure Is Code with the AWS Cloud Development Kit (DEV372) - AWS re:I...Amazon Web Services

Devops with Python by Yaniv Cohen DevopShiftYaniv cohen

Build and Deploy Cloud Native Camel Quarkus routes with Tekton and KnativeOmar Al-Safi

Introducing TiDB - Percona Live FrankfurtMorgan Tocker

Win Spinnaker with Winnaker - Open Source North Conf 2017Medya Ghazizadeh

DevOps Workflow: A Tutorial on Linux Containersinside-BigData.com

Neighborly nagiosDavid Josephsen

SouJava May 2020: Apache Camel 3 - the next generation of enterprise integrationClaus Ibsen

Wido den Hollander - building highly available cloud with Ceph and CloudStackShapeBlue

Optimising Productivity with AWS Developer ToolsAmazon Web Services

Barak Merimovich (GIgaSpaces) & Gal Moav (Ravello) - Devstack on Demand, Open...Cloud Native Day Tel Aviv

Build a Deep Learning App with Tensorflow & Redis by Jayesh Ahire and Sherin ...Redis Labs

Similaire à Netflix Cloud Security Overview (20)

Instrument Rack to visualize  Rails requests processing

DevOpsDays Taipei 2019 - Mastering IaC the DevOps Way

Pipeline as code for your infrastructure as Code

Hardening Kubernetes Cluster

Introducing CQ 5.1

Containing Chaos with Kubernetes - Terrence Ryan, Google - DevOpsDays Tel Avi...

Creating pools of Virtual Machines - ApacheCon NA 2013

Live traffic capture and replay in cassandra 4.0

Infrastructure Is Code with the AWS Cloud Development Kit (DEV372) - AWS re:I...

Devops with Python by Yaniv Cohen DevopShift

Build and Deploy Cloud Native Camel Quarkus routes with Tekton and Knative

Introducing TiDB - Percona Live Frankfurt

Win Spinnaker with Winnaker - Open Source North Conf 2017

DevOps Workflow: A Tutorial on Linux Containers

Neighborly nagios

SouJava May 2020: Apache Camel 3 - the next generation of enterprise integration

Wido den Hollander - building highly available cloud with Ceph and CloudStack

Optimising Productivity with AWS Developer Tools

Barak Merimovich (GIgaSpaces) & Gal Moav (Ravello) - Devstack on Demand, Open...

Build a Deep Learning App with Tensorflow & Redis by Jayesh Ahire and Sherin ...

Plus de Amazon Web Services

Come costruire servizi di Forecasting sfruttando algoritmi di ML e deep learn...Amazon Web Services

Big Data per le Startup: come creare applicazioni Big Data in modalità Server...Amazon Web Services

Esegui pod serverless con Amazon EKS e AWS FargateAmazon Web Services

Costruire Applicazioni Moderne con AWSAmazon Web Services

Come spendere fino al 90% in meno con i container e le istanze spot Amazon Web Services

Open banking as a serviceAmazon Web Services

Rendi unica l’offerta della tua startup sul mercato con i servizi Machine Lea...Amazon Web Services

OpsWorks Configuration Management: automatizza la gestione e i deployment del...Amazon Web Services

Microsoft Active Directory su AWS per supportare i tuoi Windows WorkloadsAmazon Web Services

Computer Vision con AWSAmazon Web Services

Database Oracle e VMware Cloud on AWS i miti da sfatareAmazon Web Services

Crea la tua prima serverless ledger-based app con QLDB e NodeJSAmazon Web Services

API moderne real-time per applicazioni mobili e webAmazon Web Services

Database Oracle e VMware Cloud™ on AWS: i miti da sfatareAmazon Web Services

Tools for building your MVP on AWSAmazon Web Services

How to Build a Winning Pitch DeckAmazon Web Services

Building a web application without serversAmazon Web Services

Fundraising EssentialsAmazon Web Services

AWS_HK_StartupDay_Building Interactive websites while automating for efficien...Amazon Web Services

Introduzione a Amazon Elastic Container ServiceAmazon Web Services

Plus de Amazon Web Services (20)

Come costruire servizi di Forecasting sfruttando algoritmi di ML e deep learn...

Big Data per le Startup: come creare applicazioni Big Data in modalità Server...

Esegui pod serverless con Amazon EKS e AWS Fargate

Costruire Applicazioni Moderne con AWS

Come spendere fino al 90% in meno con i container e le istanze spot

Open banking as a service

Rendi unica l’offerta della tua startup sul mercato con i servizi Machine Lea...

OpsWorks Configuration Management: automatizza la gestione e i deployment del...

Microsoft Active Directory su AWS per supportare i tuoi Windows Workloads

Computer Vision con AWS

Database Oracle e VMware Cloud on AWS i miti da sfatare

Crea la tua prima serverless ledger-based app con QLDB e NodeJS

API moderne real-time per applicazioni mobili e web

Database Oracle e VMware Cloud™ on AWS: i miti da sfatare

Tools for building your MVP on AWS

How to Build a Winning Pitch Deck

Building a web application without servers

Fundraising Essentials

AWS_HK_StartupDay_Building Interactive websites while automating for efficien...

Introduzione a Amazon Elastic Container Service