SlideShare une entreprise Scribd logo
1  sur  57
NetflixSecurityOverview
1
WillBengtsonSeniorCloudSecurityEngineer
1
2
whoami
●SeniorSecurityEngineer-SecurityToolsandOperations
●Raytheon->Cigital->Lockheed->Nuna->Netflix
●SecurityBSides
●OWASPBayArea
●GoGiants!
Welcometo
IntheheartofSiliconValley
Sourceofmajortechnologicalinnovation!
NotaTechCompany!
3
●100M+Subscribers
●1000sdevices
●Worldwidereach
●3globalregions
●GlobalCDN
●⅓ofUSBandwidthatPeak
●100M+hoursofTV
●NetflixOriginals
4
AboutUs
WhatmakesNetflixcooland
different?Ourculture
-FreedomandResponsibility
-ContextnotControl
-LooselyCoupledyetHighlyAligned
Seealso:NetflixCultureSlideDeckonjobs.netflix.com
Culture
5
100(0)’sofdevelopers
1000’sofapplications
100k+instances
200+codedeploymentsaday
6
Security,theenabler!
●Notagatekeeper
●Partnerwithdevelopers
●Abstractdifficulties
●Findfaultsbeforetheyaredeployed
●FindfaultsASAPwhentheyaredeployed
●AutomateEverything
7
Butwearen’tinthecloud!
8
Therealchallenges:
Dynamicenvironment
Hugescale
Diverseapplications
Traditional
Firewall
RBAC
Cluster
Syslog
VLAN
Datacenter
9
Myothercomputeristhe
cloud
AWS
SecurityGroup
IAMRole
AutoScalingGroup
Cloudwatch
VPC
Region
Traditional
Server
BigServer
Oracle/MySQL
MessageQueue
NoSQL/K:V
Hadoop
SourceCode
10
Myothercomputeristhe
cloud
AWS
EC2Instance
EC2Instance
AWSRDS
SQS/SNS
Dynamo
EMR
GitHub*/CodeCommit
Traditional
RedHat/Ubuntu
Windows
LDAP,AAA,SSO
Fileserver
Everythingelse
11
Myothercomputeristhe
cloud
AWS
RedHat/Ubuntu
Windows
LDAP,AAA,SSO
VirtualFS,EFS,S3
ProbablyhasanAMI
12
Typically,howdoyou:
●Createauseraccount
●Inventoryyoursystems
●Updateafirewallconfig
●Makeaforensicimage
●DisableaMFAtoken
●CreateUser()
●DescribeInstances()
●AuthorizeSecurityGroupIngress()
●CreateSnapshot()
●DeactivateMFADevice()
KeyChallenges
Manyapplications,manydifferentsecurityneeds
Developershaveveryopenaccess,implementtheirownsecurity
CloudSecurityhastomonitorupto100k+instances
Smallsecurityteams,manycustomers
13
14
Strategies/Bets
●FocusonenablingNetflixtoinnovatewhileeffectivelymanagingbusinessrisk
●Facilitateengineeringandoperationalagilitywithcreativesecuritysolutions
●Integratesecuritycontrolswithexistingtools,processes,systems,and
constructs
●Guardrailsratherthangates-allowNetflixtomovefastwhilestayingsafeand
minimizetheideaof‘securityapprovals’or‘roadblocks’
15
Strategies/Bets
●Seektoseamlesslyintegratepreventivetechniques,enablebroaddetective
capabilities,andmaintaintheabilitytorapidlyrespondtoandrecoverfrom
securityincidents
●Usearisk-basedapproachtoallocateresourcesandprioritizeefforts-inother
words,noteverythingcanbeprotectedequally,andtrade-offsmustbemade
(andwemakethesetrade-offsexplicit)
●Emphasizeinternalandexternalcommunicationanddatasharingtobenefit
efficacy,cross-pollination,teamdevelopment,andrecruiting
SuccessfulMethodologies
Gatherasmuchdataaswecan,automatically
Keepthatdataupdated,automatically
Analyzethedataandalertonhighestriskorinterestissues
Providefeedbackmechanismstodevelopers
Determinewhatwehaven’tautomatedyet
Determinewhatwehaven’tmadeeasierforourdevelopersyet
16
17
AWSOrganizations
18
RootAccountMFA
19
IAM
●BaselineIAMPolicyforallapplications
●Erroronpermissivesideanddialbacklater
●Maintainconsistencyacrossaccounts
20
Spinnaker
ContinuousDeploymentfortheEnterprise
21
ImmutableInfrastructure
22
BaseAMI
23
CloudTrail
24
VPCFlowLogs
25
SecurityGroups
●CentralServices
●Cluster
●ELB
26
ELB/ALB
27
CloudwatchEventRules
28
Lambda
●Dangerous
●ScalesNicely
●CarefulwithVPCLambda
29
ChatOps
30
31
32
33
34
Strongsetoftools,stillgrowing
Variousgroupsdevelopnewtools
ManyareOpenSourced
35
Cryptex
Cryptoframework
ProvidesAPIsfordevelopers
ProvidessimpleraccesstohostedHardwareSecurityModules
36
Awwwdit/Overwatch
Collectsmetadatafromallouraccounts
Reportsaboutallofourenvironment
37
LazyFalcon
APIToaccessIPaddressinformation
Interfaceswiththreatintelfeeds
GeoIPandblacklistmanagement
38
SketchyScreenshotter
APIoriented,safe(ish),websitescreenshottool
Besteffortatoftakingscreenshotsof“modern”websites
Scalable
A“safer”waytoseewhat’sonawebsite
OpenSourced!
39
SleepyPuppy
XSSScriptingscanningframework
AsyncXSStriggerlisteningserver
Massivefunctionality
Opensourced!
40
FIDO
Automatesmuchoftheinitialincidenceresponseofsystems
OpenSourced!
41
Speedbump
Realtimeanalysisofedgetraffic
Identifieshostiletraffic,pushesrulestotheedgefor
blocking/throttling
42
OngoingResearchandDevelopment
43
Summary
Whatisoldisnewagain
The“cloud”isjustanotherdatacenterimplementation,justbigger
Automateeverything
Monitortowatchforunexpectedchanges
Analyzeexistingcontrol,derivenewcontrols
Scaneverything,andthenscanitagain
KeepaneyeoutwardsforOSINT
Makethingseasierondevelopers--ifitiseasy,theywilluseit
44
45
Questions?
https://www.github.com/netflix
https://www.github.com/netflix-skunkworks
ChaosMonkey
-Killsinstances,developersdevelopfor
failure
-Killsentireregions,developersdevelopfor
massivefailure
46
SecurityMonkey
Monitorsthesecurityenvironment
Alertsonchanges
Alertsonbadthings
Provideshistory
47
RepoMan
Monitorsactualusagebyroles/users
Identifieswhatcanbeminimizedforleased
privileges
48
MakesAWSAccessAdvisorinformationavailable
viaAPIforusebyRepokid
Aardvark
49
Identifieswhatcanberight-sizedforleastprivilege
Repokid
50
SecurityGrouper
SecurityGroupmanagementtool
Objectmodelforsecuritygroup
Identifieserrorswithsecuritygroups
archives,syncs,andbuildssecuritygroups
51
Lemur
x509Certificatemanagementpackage
InternalCA
ExternalCA
InterfaceswithServices
Supersimplefordevelopers
52
RolliePollie
ManagesrolesoverourAWSaccounts
53
Monterey
-Discoversthealloftheservicesandsystems
-Scansthesystems,constantly
-Pluginsfornmap,Arachni
-Scaleable,chainable
54
Scumblr
Initially,FrameworkforgatheringOSINT
Growingframeworkforworkflows
IntegrateswithMontereyandotherscanningsources
55
PenguinShortbread
Automatedriskanalysistool
Analyzessystemdependenciesandappliesriskprofiles
56
57
Meechum
SingleSign-On

Contenu connexe

Similaire à Netflix Cloud Security Overview

Netflix Cloud Architecture and Open Source
Netflix Cloud Architecture and Open SourceNetflix Cloud Architecture and Open Source
Netflix Cloud Architecture and Open Sourceaspyker
 
Netflix AIM Engineering Manager
Netflix AIM Engineering ManagerNetflix AIM Engineering Manager
Netflix AIM Engineering ManagerKaren Casella
 
Industrial light & magic success story case study iv (python based company)
Industrial light & magic success story  case study iv (python based company)Industrial light & magic success story  case study iv (python based company)
Industrial light & magic success story case study iv (python based company)Sting Chen
 
Pol Vanbiervliet, Cisco: remove the barriers between space and time
Pol Vanbiervliet, Cisco: remove the barriers between space and timePol Vanbiervliet, Cisco: remove the barriers between space and time
Pol Vanbiervliet, Cisco: remove the barriers between space and timeQuadrant Communications
 
Zero To Cloud (OSCon 2014)
Zero To Cloud (OSCon 2014)Zero To Cloud (OSCon 2014)
Zero To Cloud (OSCon 2014)Justin Ryan
 
CineGrid: An Innovative High End Digital Media Collaboration
CineGrid: An Innovative High End Digital Media CollaborationCineGrid: An Innovative High End Digital Media Collaboration
CineGrid: An Innovative High End Digital Media CollaborationLarry Smarr
 
Netflix Research Paper Outline
Netflix Research Paper OutlineNetflix Research Paper Outline
Netflix Research Paper OutlineKate Subramanian
 
OSDC 2016 - Another 7 Tools for your #devops Stack by Kris Buytaert
OSDC 2016 - Another 7 Tools for your #devops Stack by Kris BuytaertOSDC 2016 - Another 7 Tools for your #devops Stack by Kris Buytaert
OSDC 2016 - Another 7 Tools for your #devops Stack by Kris BuytaertNETWAYS
 
Another 7 tools for your #devops stack
Another 7 tools for your #devops stackAnother 7 tools for your #devops stack
Another 7 tools for your #devops stackKris Buytaert
 
Netflix Playback Access Team
Netflix Playback Access TeamNetflix Playback Access Team
Netflix Playback Access TeamKaren Casella
 
What's Now - Gustavo Carriquiry
What's Now - Gustavo CarriquiryWhat's Now - Gustavo Carriquiry
What's Now - Gustavo CarriquiryGeneXus
 
OpenSource SmartGrid: Teeters tail-of-possibilities 8dec11
OpenSource SmartGrid: Teeters tail-of-possibilities 8dec11OpenSource SmartGrid: Teeters tail-of-possibilities 8dec11
OpenSource SmartGrid: Teeters tail-of-possibilities 8dec11Stan Curtis
 
Netflix Playback Access Team
Netflix Playback Access TeamNetflix Playback Access Team
Netflix Playback Access TeamKaren Casella
 
Canary Analyze All the Things
Canary Analyze All the ThingsCanary Analyze All the Things
Canary Analyze All the Thingsroyrapoport
 
IWMW 1999: Multimedia and the corporate web
IWMW 1999: Multimedia and the corporate webIWMW 1999: Multimedia and the corporate web
IWMW 1999: Multimedia and the corporate webIWMW
 
[Cryptica 22] Tenderly - Your Lens To Blockchain - Nebojsa Urosevic
[Cryptica 22] Tenderly - Your Lens To Blockchain - Nebojsa Urosevic[Cryptica 22] Tenderly - Your Lens To Blockchain - Nebojsa Urosevic
[Cryptica 22] Tenderly - Your Lens To Blockchain - Nebojsa UrosevicDataScienceConferenc1
 
OIT Technology, Communications, Japan
OIT Technology, Communications, JapanOIT Technology, Communications, Japan
OIT Technology, Communications, JapanChristos Makiyama
 

Similaire à Netflix Cloud Security Overview (20)

Linux journal
Linux journalLinux journal
Linux journal
 
Netflix Cloud Architecture and Open Source
Netflix Cloud Architecture and Open SourceNetflix Cloud Architecture and Open Source
Netflix Cloud Architecture and Open Source
 
Netflix AIM Engineering Manager
Netflix AIM Engineering ManagerNetflix AIM Engineering Manager
Netflix AIM Engineering Manager
 
Industrial light & magic success story case study iv (python based company)
Industrial light & magic success story  case study iv (python based company)Industrial light & magic success story  case study iv (python based company)
Industrial light & magic success story case study iv (python based company)
 
You, Mix and Kubee
You, Mix and KubeeYou, Mix and Kubee
You, Mix and Kubee
 
Pol Vanbiervliet, Cisco: remove the barriers between space and time
Pol Vanbiervliet, Cisco: remove the barriers between space and timePol Vanbiervliet, Cisco: remove the barriers between space and time
Pol Vanbiervliet, Cisco: remove the barriers between space and time
 
Google Fiber
Google FiberGoogle Fiber
Google Fiber
 
Zero To Cloud (OSCon 2014)
Zero To Cloud (OSCon 2014)Zero To Cloud (OSCon 2014)
Zero To Cloud (OSCon 2014)
 
CineGrid: An Innovative High End Digital Media Collaboration
CineGrid: An Innovative High End Digital Media CollaborationCineGrid: An Innovative High End Digital Media Collaboration
CineGrid: An Innovative High End Digital Media Collaboration
 
Netflix Research Paper Outline
Netflix Research Paper OutlineNetflix Research Paper Outline
Netflix Research Paper Outline
 
OSDC 2016 - Another 7 Tools for your #devops Stack by Kris Buytaert
OSDC 2016 - Another 7 Tools for your #devops Stack by Kris BuytaertOSDC 2016 - Another 7 Tools for your #devops Stack by Kris Buytaert
OSDC 2016 - Another 7 Tools for your #devops Stack by Kris Buytaert
 
Another 7 tools for your #devops stack
Another 7 tools for your #devops stackAnother 7 tools for your #devops stack
Another 7 tools for your #devops stack
 
Netflix Playback Access Team
Netflix Playback Access TeamNetflix Playback Access Team
Netflix Playback Access Team
 
What's Now - Gustavo Carriquiry
What's Now - Gustavo CarriquiryWhat's Now - Gustavo Carriquiry
What's Now - Gustavo Carriquiry
 
OpenSource SmartGrid: Teeters tail-of-possibilities 8dec11
OpenSource SmartGrid: Teeters tail-of-possibilities 8dec11OpenSource SmartGrid: Teeters tail-of-possibilities 8dec11
OpenSource SmartGrid: Teeters tail-of-possibilities 8dec11
 
Netflix Playback Access Team
Netflix Playback Access TeamNetflix Playback Access Team
Netflix Playback Access Team
 
Canary Analyze All the Things
Canary Analyze All the ThingsCanary Analyze All the Things
Canary Analyze All the Things
 
IWMW 1999: Multimedia and the corporate web
IWMW 1999: Multimedia and the corporate webIWMW 1999: Multimedia and the corporate web
IWMW 1999: Multimedia and the corporate web
 
[Cryptica 22] Tenderly - Your Lens To Blockchain - Nebojsa Urosevic
[Cryptica 22] Tenderly - Your Lens To Blockchain - Nebojsa Urosevic[Cryptica 22] Tenderly - Your Lens To Blockchain - Nebojsa Urosevic
[Cryptica 22] Tenderly - Your Lens To Blockchain - Nebojsa Urosevic
 
OIT Technology, Communications, Japan
OIT Technology, Communications, JapanOIT Technology, Communications, Japan
OIT Technology, Communications, Japan
 

Plus de Amazon Web Services

Come costruire servizi di Forecasting sfruttando algoritmi di ML e deep learn...
Come costruire servizi di Forecasting sfruttando algoritmi di ML e deep learn...Come costruire servizi di Forecasting sfruttando algoritmi di ML e deep learn...
Come costruire servizi di Forecasting sfruttando algoritmi di ML e deep learn...Amazon Web Services
 
Big Data per le Startup: come creare applicazioni Big Data in modalità Server...
Big Data per le Startup: come creare applicazioni Big Data in modalità Server...Big Data per le Startup: come creare applicazioni Big Data in modalità Server...
Big Data per le Startup: come creare applicazioni Big Data in modalità Server...Amazon Web Services
 
Esegui pod serverless con Amazon EKS e AWS Fargate
Esegui pod serverless con Amazon EKS e AWS FargateEsegui pod serverless con Amazon EKS e AWS Fargate
Esegui pod serverless con Amazon EKS e AWS FargateAmazon Web Services
 
Costruire Applicazioni Moderne con AWS
Costruire Applicazioni Moderne con AWSCostruire Applicazioni Moderne con AWS
Costruire Applicazioni Moderne con AWSAmazon Web Services
 
Come spendere fino al 90% in meno con i container e le istanze spot
Come spendere fino al 90% in meno con i container e le istanze spot Come spendere fino al 90% in meno con i container e le istanze spot
Come spendere fino al 90% in meno con i container e le istanze spot Amazon Web Services
 
Rendi unica l’offerta della tua startup sul mercato con i servizi Machine Lea...
Rendi unica l’offerta della tua startup sul mercato con i servizi Machine Lea...Rendi unica l’offerta della tua startup sul mercato con i servizi Machine Lea...
Rendi unica l’offerta della tua startup sul mercato con i servizi Machine Lea...Amazon Web Services
 
OpsWorks Configuration Management: automatizza la gestione e i deployment del...
OpsWorks Configuration Management: automatizza la gestione e i deployment del...OpsWorks Configuration Management: automatizza la gestione e i deployment del...
OpsWorks Configuration Management: automatizza la gestione e i deployment del...Amazon Web Services
 
Microsoft Active Directory su AWS per supportare i tuoi Windows Workloads
Microsoft Active Directory su AWS per supportare i tuoi Windows WorkloadsMicrosoft Active Directory su AWS per supportare i tuoi Windows Workloads
Microsoft Active Directory su AWS per supportare i tuoi Windows WorkloadsAmazon Web Services
 
Database Oracle e VMware Cloud on AWS i miti da sfatare
Database Oracle e VMware Cloud on AWS i miti da sfatareDatabase Oracle e VMware Cloud on AWS i miti da sfatare
Database Oracle e VMware Cloud on AWS i miti da sfatareAmazon Web Services
 
Crea la tua prima serverless ledger-based app con QLDB e NodeJS
Crea la tua prima serverless ledger-based app con QLDB e NodeJSCrea la tua prima serverless ledger-based app con QLDB e NodeJS
Crea la tua prima serverless ledger-based app con QLDB e NodeJSAmazon Web Services
 
API moderne real-time per applicazioni mobili e web
API moderne real-time per applicazioni mobili e webAPI moderne real-time per applicazioni mobili e web
API moderne real-time per applicazioni mobili e webAmazon Web Services
 
Database Oracle e VMware Cloud™ on AWS: i miti da sfatare
Database Oracle e VMware Cloud™ on AWS: i miti da sfatareDatabase Oracle e VMware Cloud™ on AWS: i miti da sfatare
Database Oracle e VMware Cloud™ on AWS: i miti da sfatareAmazon Web Services
 
Tools for building your MVP on AWS
Tools for building your MVP on AWSTools for building your MVP on AWS
Tools for building your MVP on AWSAmazon Web Services
 
How to Build a Winning Pitch Deck
How to Build a Winning Pitch DeckHow to Build a Winning Pitch Deck
How to Build a Winning Pitch DeckAmazon Web Services
 
Building a web application without servers
Building a web application without serversBuilding a web application without servers
Building a web application without serversAmazon Web Services
 
AWS_HK_StartupDay_Building Interactive websites while automating for efficien...
AWS_HK_StartupDay_Building Interactive websites while automating for efficien...AWS_HK_StartupDay_Building Interactive websites while automating for efficien...
AWS_HK_StartupDay_Building Interactive websites while automating for efficien...Amazon Web Services
 
Introduzione a Amazon Elastic Container Service
Introduzione a Amazon Elastic Container ServiceIntroduzione a Amazon Elastic Container Service
Introduzione a Amazon Elastic Container ServiceAmazon Web Services
 

Plus de Amazon Web Services (20)

Come costruire servizi di Forecasting sfruttando algoritmi di ML e deep learn...
Come costruire servizi di Forecasting sfruttando algoritmi di ML e deep learn...Come costruire servizi di Forecasting sfruttando algoritmi di ML e deep learn...
Come costruire servizi di Forecasting sfruttando algoritmi di ML e deep learn...
 
Big Data per le Startup: come creare applicazioni Big Data in modalità Server...
Big Data per le Startup: come creare applicazioni Big Data in modalità Server...Big Data per le Startup: come creare applicazioni Big Data in modalità Server...
Big Data per le Startup: come creare applicazioni Big Data in modalità Server...
 
Esegui pod serverless con Amazon EKS e AWS Fargate
Esegui pod serverless con Amazon EKS e AWS FargateEsegui pod serverless con Amazon EKS e AWS Fargate
Esegui pod serverless con Amazon EKS e AWS Fargate
 
Costruire Applicazioni Moderne con AWS
Costruire Applicazioni Moderne con AWSCostruire Applicazioni Moderne con AWS
Costruire Applicazioni Moderne con AWS
 
Come spendere fino al 90% in meno con i container e le istanze spot
Come spendere fino al 90% in meno con i container e le istanze spot Come spendere fino al 90% in meno con i container e le istanze spot
Come spendere fino al 90% in meno con i container e le istanze spot
 
Open banking as a service
Open banking as a serviceOpen banking as a service
Open banking as a service
 
Rendi unica l’offerta della tua startup sul mercato con i servizi Machine Lea...
Rendi unica l’offerta della tua startup sul mercato con i servizi Machine Lea...Rendi unica l’offerta della tua startup sul mercato con i servizi Machine Lea...
Rendi unica l’offerta della tua startup sul mercato con i servizi Machine Lea...
 
OpsWorks Configuration Management: automatizza la gestione e i deployment del...
OpsWorks Configuration Management: automatizza la gestione e i deployment del...OpsWorks Configuration Management: automatizza la gestione e i deployment del...
OpsWorks Configuration Management: automatizza la gestione e i deployment del...
 
Microsoft Active Directory su AWS per supportare i tuoi Windows Workloads
Microsoft Active Directory su AWS per supportare i tuoi Windows WorkloadsMicrosoft Active Directory su AWS per supportare i tuoi Windows Workloads
Microsoft Active Directory su AWS per supportare i tuoi Windows Workloads
 
Computer Vision con AWS
Computer Vision con AWSComputer Vision con AWS
Computer Vision con AWS
 
Database Oracle e VMware Cloud on AWS i miti da sfatare
Database Oracle e VMware Cloud on AWS i miti da sfatareDatabase Oracle e VMware Cloud on AWS i miti da sfatare
Database Oracle e VMware Cloud on AWS i miti da sfatare
 
Crea la tua prima serverless ledger-based app con QLDB e NodeJS
Crea la tua prima serverless ledger-based app con QLDB e NodeJSCrea la tua prima serverless ledger-based app con QLDB e NodeJS
Crea la tua prima serverless ledger-based app con QLDB e NodeJS
 
API moderne real-time per applicazioni mobili e web
API moderne real-time per applicazioni mobili e webAPI moderne real-time per applicazioni mobili e web
API moderne real-time per applicazioni mobili e web
 
Database Oracle e VMware Cloud™ on AWS: i miti da sfatare
Database Oracle e VMware Cloud™ on AWS: i miti da sfatareDatabase Oracle e VMware Cloud™ on AWS: i miti da sfatare
Database Oracle e VMware Cloud™ on AWS: i miti da sfatare
 
Tools for building your MVP on AWS
Tools for building your MVP on AWSTools for building your MVP on AWS
Tools for building your MVP on AWS
 
How to Build a Winning Pitch Deck
How to Build a Winning Pitch DeckHow to Build a Winning Pitch Deck
How to Build a Winning Pitch Deck
 
Building a web application without servers
Building a web application without serversBuilding a web application without servers
Building a web application without servers
 
Fundraising Essentials
Fundraising EssentialsFundraising Essentials
Fundraising Essentials
 
AWS_HK_StartupDay_Building Interactive websites while automating for efficien...
AWS_HK_StartupDay_Building Interactive websites while automating for efficien...AWS_HK_StartupDay_Building Interactive websites while automating for efficien...
AWS_HK_StartupDay_Building Interactive websites while automating for efficien...
 
Introduzione a Amazon Elastic Container Service
Introduzione a Amazon Elastic Container ServiceIntroduzione a Amazon Elastic Container Service
Introduzione a Amazon Elastic Container Service
 

Netflix Cloud Security Overview