Microservices give us many options. We can pick different technologies, mix synchronous and asynchronous integration techniques or embrace different deployment patterns. But they also give us different options in how we think about securing our systems. Done right, and microservices can increase the security of your vital data and processes. Done wrong, and you can increase the surface area of attack. This talk will discuss the importance of defence in depth, discussing the many different ways in which you can secure your fine-grained, distributed architectures.

1. APPSEC AND
MICROSERVICES
Sam Newman
O’Reilly Software Architecture Conference, NYC 2016

2. @samnewman

3. @samnewman

4. @samnewmanhttps://www.flickr.com/photos/seattlemunicipalarchives/4058808950

5. @samnewmanhttps://www.flickr.com/photos/theseanster93/485390997/

6. @samnewman
http://map.norsecorp.com/

7. @samnewman

8. @samnewman

9. @samnewman
Accounts
Returns
Invoicing
Shipping
Inventory
Customer
Service

10. @samnewman
Accounts
Returns
Invoicing
Shipping
Inventory
Customer
Service
Small Autonomous services that
work together, modelled around
a business domain

11. https://www.flickr.com/photos/wwworks/2607036664/

12. https://www.flickr.com/photos/lkowen/15803718243/

13. @samnewman

14. @samnewman

15. @samnewman

16. @samnewman

17. @samnewman

18. @samnewman
Prevention

19. @samnewman
Prevention Detection

20. @samnewman
Prevention Detection
Response

21. @samnewman
Prevention Detection
ResponseRecovery

22. @samnewman
Prevention Detection
ResponseRecovery

23. @samnewman
Prevention Detection
ResponseRecovery

24. @samnewmanhttps://www.flickr.com/photos/adulau/15680439035/

25. @samnewmanhttps://www.flickr.com/photos/duanestorey/469163789/

26. @samnewman
https://www.schneier.com/paper-attacktrees-ddj-ft.html

27. @samnewman
Open Safe

28. @samnewman
Open Safe
Pick Lock Learn Combo Cut Open

29. @samnewman
Open Safe
Pick Lock Learn Combo Cut Open
Find Written
Combo
Get Combo from
the target

30. @samnewman
Open Safe
Pick Lock Learn Combo Cut Open
Find Written
Combo
Get Combo from
the target
Blackmail Threaten Bribe

31. @samnewman
Open Safe
Pick Lock Learn Combo Cut Open
Find Written
Combo
Get Combo from
the target
Blackmail Threaten Bribe
Impossible
Impossible Impossible
Possible
Possible
Possible

32. @samnewman
Catalog
service
Music
Web Shop
Recommend
service
Royalty
Payment
Gateway
Mobile
app
Web
browsers
User
service

33. @samnewman
Catalog
service
Music
Web Shop
Recommend
service
Royalty
Payment
Gateway
Mobile
app
Web
browsers
User
service
Transport Security

34. @samnewman
HTTPS Everywhere!

35. BENEFITS OF HTTPS?

36. BENEFITS OF HTTPS?
▫︎Server guarantees!

37. BENEFITS OF HTTPS?
▫︎Server guarantees!
▫︎Payload not manipulated…

38. BENEFITS OF HTTPS?
▫︎Server guarantees!
▫︎Payload not manipulated…
▫︎…but no client guarantee and…

39. BENEFITS OF HTTPS?
▫︎Server guarantees!
▫︎Payload not manipulated…
▫︎…but no client guarantee and…
▫︎…certificates can be a pain

40. @samnewman
https://letsencrypt.org/

41. @samnewman

42. Catalog
service
Music
Web Shop
Recommend
service
Royalty
Payment
Gateway
Mobile
app
Web
browsers
User
service

43. CLIENT-SIDE CERTIFICATES?

44. CLIENT-SIDE CERTIFICATES?
▫︎Client guarantees!

45. CLIENT-SIDE CERTIFICATES?
▫︎Client guarantees!
▫︎…but a PITA to manage….

46. @samnewman
http://techblog.netflix.com/2015/09/introducing-lemur.html

47. @samnewman
Catalog
service
Music
Web Shop
Recommend
service
Royalty
Payment
Gateway
Mobile
app
Web
browsers
User
service

48. @samnewman
Auth?

49. @samnewman
Catalog
service
Music
Web Shop
Recommend
service
Royalty
Payment
Gateway
Mobile
app
Web
browsers
User
service
Web
browsers
Form AuthOAuth

50. @samnewman
Catalog
service
Music
Web Shop
Recommend
service
Royalty
Payment
Gateway
Mobile
app
Web
browsers
User
service
Web
browsers
Form AuthOAuth
User
service

51. @samnewman
Catalog
service
Music
Web Shop
Recommend
service
Royalty
Payment
Gateway
Mobile
app
Web
browsers
User
service
Web
browsers
Form AuthOAuth
User
service

52. @samnewman
Confused Deputy Problem!

53. @samnewman
Data At Rest?

54. @samnewman
Catalog
service
Music
Web Shop
Recommend
service
Royalty
Payment
Gateway
Mobile
app
Web
browsers
User
service
User
service

55. @samnewman
Patch Your Stuff

56. @samnewman
Prevention Detection
ResponseRecovery

57. @samnewman
Prevention Detection
ResponseRecovery

58. @samnewman
https://www.qualys.com/research/top10/

59. @samnewman

60. @samnewman
https://www.modsecurity.org/

61. @samnewman
Catalog
service
Music
Web Shop
Recommend
service
Royalty
service
Mobile
app
Web
browsers
User
service

62. @samnewman
Catalog
service
Music
Web Shop
Recommend
service
Royalty
service
Mobile
app
Web
browsers
User
service
PERIMITER SECURITY!

63. @samnewman
Polyglot = more stuff to track!

64. @samnewman
Polyglot = more things to break?

65. @samnewman
Prevention Detection
ResponseRecovery

66. @samnewman
Prevention Detection
ResponseRecovery

67. @samnewman

68. @samnewman

69. @samnewman

70. @samnewmanhttp://krebsonsecurity.com/tag/target-data-breach/

71. @samnewman
Comms

72. @samnewman

73. @samnewman

74. @samnewman
https://en.wikipedia.org/wiki/Chicago_Tylenol_murders

75. @samnewman
Prevention Detection
ResponseRecovery

76. @samnewman
Prevention Detection
ResponseRecovery

77. @samnewman
Backups

78. @samnewman
Backups
Burn it all down

79. @samnewman
Backups
Burn it all down
Harder with microservices?

80. @samnewman
Prevention Detection
ResponseRecovery

81. @samnewman
Sam Newman
Building
Microservices
DESIGNING FINE-GRAINED SYSTEMS
http://buildingmicroservices.com/

82. @samnewman
Sam Newman
Building
Microservices
DESIGNING FINE-GRAINED SYSTEMS
http://buildingmicroservices.com/
http://samnewman.io/

83. @samnewman
Sam Newman
Building
Microservices
DESIGNING FINE-GRAINED SYSTEMS
http://buildingmicroservices.com/
http://magpietalkshow.com/
http://samnewman.io/

84. @samnewman
snewman@thoughtworks.com
THANKS!