SpringOne Platform 2019 Session Title: How to Build More Secure Service Brokers Speaker: Denise Yu, Pivotal Youtube: https://youtu.be/8hZ70khFXSs

1. How to Build More
Secure Service Brokers
Denise Yu @deniseyu21
Senior Software Engineer, Pivotal R&D
October 7–10, 2019
Austin Convention Center

2. Unless otherwise indicated, these slides are © 2013-2019 Pivotal Software, Inc. and licensed under a Creative Commons Attribution-NonCommercial license: http://creativecommons.org/licenses/by-nc/3.0/
Hello #s1p!
Senior Engineer @ Pivotal, currently
engineer on Concourse CI open source,
full-time YAML wrangler, distsys doodler,
storyteller, keynote-deliverer
Previously:
Product Manager for On-Demand Service
Broker SDK
Engineered on
➔ BOSH core
➔ Cloud Foundry Services API
➔ RabbitMQ for Pivotal Cloud Foundry
service
2
@deniseyu21 deniseyu.io
dyu@pivotal.io

3. Unless otherwise indicated, these slides are © 2013-2019 Pivotal Software, Inc. and licensed under a Creative Commons Attribution-NonCommercial license: http://creativecommons.org/licenses/by-nc/3.0/
What’s a service broker?

4. Unless otherwise indicated, these slides are © 2013-2019 Pivotal Software, Inc. and licensed under a Creative Commons Attribution-NonCommercial license: http://creativecommons.org/licenses/by-nc/3.0/
What problem do service brokers solve?
● Cloud Foundry, Knative, and other application platforms are great at managing
the deployment and lifecycle of stateless applications

5. Unless otherwise indicated, these slides are © 2013-2019 Pivotal Software, Inc. and licensed under a Creative Commons Attribution-NonCommercial license: http://creativecommons.org/licenses/by-nc/3.0/
What problem do service brokers solve?
● Cloud Foundry, Knative, and other application platforms are great at managing
the deployment and lifecycle of stateless applications
● But applications need persistent data! (usually)

6. Unless otherwise indicated, these slides are © 2013-2019 Pivotal Software, Inc. and licensed under a Creative Commons Attribution-NonCommercial license: http://creativecommons.org/licenses/by-nc/3.0/
What problem do service brokers solve?
● Cloud Foundry, Knative, and other application platforms are great at managing
the deployment and lifecycle of stateless applications
● But applications need persistent data! (usually)
● Where do we get persistent services from, after cf push?

7. Unless otherwise indicated, these slides are © 2013-2019 Pivotal Software, Inc. and licensed under a Creative Commons Attribution-NonCommercial license: http://creativecommons.org/licenses/by-nc/3.0/
What problem do service brokers solve?
● Cloud Foundry, Knative, and other application platforms are great at managing
the deployment and lifecycle of stateless applications
● But applications need persistent data! (usually)
● Where do we get persistent services from, after cf push?
○ Host it yourself, with any number of “DevOps” tools (BOSH, Kubernetes,
Ansible, Chef, etc)
○ Pay someone else to host it, aka Software-as-a-Service (ex. AWS RDS,
Firebase)

8. Unless otherwise indicated, these slides are © 2013-2019 Pivotal Software, Inc. and licensed under a Creative Commons Attribution-NonCommercial license: http://creativecommons.org/licenses/by-nc/3.0/
What problem do service brokers solve?
● Cloud Foundry, Knative, and other application platforms are great at managing
the deployment and lifecycle of stateless applications
● But applications need persistent data! (usually)
● Where do we get persistent services from, after cf push?
○ Host it yourself, with any number of “DevOps” tools (BOSH, Kubernetes,
Ansible, Chef, etc)
○ Pay someone else to host it, aka Software-as-a-Service (ex. AWS RDS,
Firebase)
● How do we manage how & when applications use services?

9. Unless otherwise indicated, these slides are © 2013-2019 Pivotal Software, Inc. and licensed under a Creative Commons Attribution-NonCommercial license: http://creativecommons.org/licenses/by-nc/3.0/
A service broker is a
component that enables
application developers to
provision new instances
of a service for their
application, when they
need it, configured how
they need it

10. Unless otherwise indicated, these slides are © 2013-2019 Pivotal Software, Inc. and licensed under a Creative Commons Attribution-NonCommercial license: http://creativecommons.org/licenses/by-nc/3.0/
Service instances can be conceptualised in many ways

11. Unless otherwise indicated, these slides are © 2013-2019 Pivotal Software, Inc. and licensed under a Creative Commons Attribution-NonCommercial license: http://creativecommons.org/licenses/by-nc/3.0/
Service instances can be conceptualised in many ways

12. Unless otherwise indicated, these slides are © 2013-2019 Pivotal Software, Inc. and licensed under a Creative Commons Attribution-NonCommercial license: http://creativecommons.org/licenses/by-nc/3.0/
Service instances can be conceptualised in many ways

13. Unless otherwise indicated, these slides are © 2013-2019 Pivotal Software, Inc. and licensed under a Creative Commons Attribution-NonCommercial license: http://creativecommons.org/licenses/by-nc/3.0/
Specification that standardizes platform-to-broker, HTTP-based communication,
using “a simple set of API endpoints which can be used to provision, gain
access to and manage service offerings.”
https://www.openservicebrokerapi.org

14. Unless otherwise indicated, these slides are © 2013-2019 Pivotal Software, Inc. and licensed under a Creative Commons Attribution-NonCommercial license: http://creativecommons.org/licenses/by-nc/3.0/

15. Unless otherwise indicated, these slides are © 2013-2019 Pivotal Software, Inc. and licensed under a Creative Commons Attribution-NonCommercial license: http://creativecommons.org/licenses/by-nc/3.0/
Service brokers are chatty!
Service brokers have many
contact points with the outside
world and with their service
instances! It’s very common to
want to ship software-specific
management consoles with
brokers, instrument them for
operability, and so on.
We’ll come back to this later!

16. Unless otherwise indicated, these slides are © 2013-2019 Pivotal Software, Inc. and licensed under a Creative Commons Attribution-NonCommercial license: http://creativecommons.org/licenses/by-nc/3.0/
Service Broker Security
Part I:
Design & Deployment

17. Unless otherwise indicated, these slides are © 2013-2019 Pivotal Software, Inc. and licensed under a Creative Commons Attribution-NonCommercial license: http://creativecommons.org/licenses/by-nc/3.0/
Is the underlying software designed
for single or multiple tenants?
1
7

18. Unless otherwise indicated, these slides are © 2013-2019 Pivotal Software, Inc. and licensed under a Creative Commons Attribution-NonCommercial license: http://creativecommons.org/licenses/by-nc/3.0/
Single-tenant vs. Multitenancy
● Isolated software instance, using
virtual or hardware-based isolation
(or combination)
● Trade in favor of stronger, multi-
layered security gains at the
expense of lost utilization
● Multiple users and/or namespaces
on single software instance, isolated
by application logic
● Trade in favor of cost effectiveness
and higher utilization at the expense
of security only at the application
layer

19. Unless otherwise indicated, these slides are © 2013-2019 Pivotal Software, Inc. and licensed under a Creative Commons Attribution-NonCommercial license: http://creativecommons.org/licenses/by-nc/3.0/
Single-tenant vs. Multitenancy
● Isolated software instance, using virtual
or hardware-based isolation (or
combination)
● Multiple users and/or namespaces on
single software instance, isolated by
application logic (higher risk of noisy
neighbors)

20. Unless otherwise indicated, these slides are © 2013-2019 Pivotal Software, Inc. and licensed under a Creative Commons Attribution-NonCommercial license: http://creativecommons.org/licenses/by-nc/3.0/
Single-tenant vs. Multitenancy
● Isolated software instance, using virtual
or hardware-based isolation (or
combination)
● Higher likelihood of underutilization
● Multiple users and/or namespaces on
single software instance, isolated by
application logic (higher risk of noisy
neighbors)
● Lower likelihood of underutilization,
better “bin packing”

21. Unless otherwise indicated, these slides are © 2013-2019 Pivotal Software, Inc. and licensed under a Creative Commons Attribution-NonCommercial license: http://creativecommons.org/licenses/by-nc/3.0/
Single-tenant vs. Multitenancy
● Isolated software instance, using virtual
or hardware-based isolation (or
combination)
● Higher likelihood of underutilization
● Tends to have slower startup
● Multiple users and/or namespaces on
single software instance, isolated by
application logic (higher risk of noisy
neighbors)
● Lower likelihood of underutilization,
better “bin packing”
● Tends to be faster to spin up

22. Unless otherwise indicated, these slides are © 2013-2019 Pivotal Software, Inc. and licensed under a Creative Commons Attribution-NonCommercial license: http://creativecommons.org/licenses/by-nc/3.0/
Align your service instance delivery models
Some products lend themselves superbly to multitenancy, such as PostgresQL and
MySQL, which have supported multiple users at the software level for many years,
and run successfully as multi-tenant SaaS offerings (Heroku, DigitalOcean, Azure,
etc).

23. Unless otherwise indicated, these slides are © 2013-2019 Pivotal Software, Inc. and licensed under a Creative Commons Attribution-NonCommercial license: http://creativecommons.org/licenses/by-nc/3.0/
Align your service instance delivery models
Some products lend themselves superbly to multitenancy, such as PostgresQL and
MySQL, which have supported multiple users at the software level for many years,
and run successfully as multi-tenant SaaS offerings (Heroku, DigitalOcean, Azure,
etc).
Others are built with a strong “trusted workload” assumption that don’t translate well
to multitenant offerings. Trying to fight the software’s tenancy abstractions will make
life hard when you’re in the business of packaging software!

24. Unless otherwise indicated, these slides are © 2013-2019 Pivotal Software, Inc. and licensed under a Creative Commons Attribution-NonCommercial license: http://creativecommons.org/licenses/by-nc/3.0/
How and where will users run
your broker and service instances?
2
4

25. Unless otherwise indicated, these slides are © 2013-2019 Pivotal Software, Inc. and licensed under a Creative Commons Attribution-NonCommercial license: http://creativecommons.org/licenses/by-nc/3.0/
Platform security
How will your operator host the service broker and instances?
Google Kubernetes Engine (GKE):
“By default, nodes are given the Compute Engine default service account… This
account has broad access by default, making it useful to wide variety of
applications, but it has more permissions than are required to run your
Kubernetes Engine cluster. You should create and use a minimally privileged
service account to run your GKE cluster instead of using the Compute Engine
default service account.”
More at
cloud.google.com/kubernetes-engine/docs/how-to/hardening-your-cluster

26. Unless otherwise indicated, these slides are © 2013-2019 Pivotal Software, Inc. and licensed under a Creative Commons Attribution-NonCommercial license: http://creativecommons.org/licenses/by-nc/3.0/
The Principle of Least Privilege
“Every program and every user of the system
should operate using the least set of
privileges necessary to complete the job.”
Jerome Saltzer & Michael Schroeder, The
Protection of Information in Computer
Systems, 1975.
web.mit.edu/Saltzer/www/publications/protection

27. Unless otherwise indicated, these slides are © 2013-2019 Pivotal Software, Inc. and licensed under a Creative Commons Attribution-NonCommercial license: http://creativecommons.org/licenses/by-nc/3.0/
Service Broker Security
Part II:
“Easy wins” and best practices

28. Unless otherwise indicated, these slides are © 2013-2019 Pivotal Software, Inc. and licensed under a Creative Commons Attribution-NonCommercial license: http://creativecommons.org/licenses/by-nc/3.0/

29. Unless otherwise indicated, these slides are © 2013-2019 Pivotal Software, Inc. and licensed under a Creative Commons Attribution-NonCommercial license: http://creativecommons.org/licenses/by-nc/3.0/
Basic auth is not auth 🌶

30. Unless otherwise indicated, these slides are © 2013-2019 Pivotal Software, Inc. and licensed under a Creative Commons Attribution-NonCommercial license: http://creativecommons.org/licenses/by-nc/3.0/
Basic auth is not auth 🌶
● Use it for testing, but disable it on prod! Off by default!

31. Unless otherwise indicated, these slides are © 2013-2019 Pivotal Software, Inc. and licensed under a Creative Commons Attribution-NonCommercial license: http://creativecommons.org/licenses/by-nc/3.0/
Basic auth is not auth 🌶
● Use it for testing, but disable it on prod! Off by default!
● Industry best practice: OAuth 2.0
○ Recommended to use UAA client

32. Unless otherwise indicated, these slides are © 2013-2019 Pivotal Software, Inc. and licensed under a Creative Commons Attribution-NonCommercial license: http://creativecommons.org/licenses/by-nc/3.0/
Basic auth is not auth 🌶
● Use it for testing, but disable it on prod! Off by default!
● Industry best practice: OAuth 2.0
○ Recommended to use UAA client
○ Perform scope-checking against Cloud Controller if designing broker for
Cloud Foundry

33. Unless otherwise indicated, these slides are © 2013-2019 Pivotal Software, Inc. and licensed under a Creative Commons Attribution-NonCommercial license: http://creativecommons.org/licenses/by-nc/3.0/
Basic auth is not auth 🌶
● Use it for testing, but disable it on prod! Off by default!
● Industry best practice: OAuth 2.0
○ Recommended to use UAA client
○ Perform scope-checking against Cloud Controller if designing broker for
Cloud Foundry
○ Don’t share UAA clients; issue one per service instance

34. Unless otherwise indicated, these slides are © 2013-2019 Pivotal Software, Inc. and licensed under a Creative Commons Attribution-NonCommercial license: http://creativecommons.org/licenses/by-nc/3.0/
Basic auth is not auth 🌶
● Use it for testing, but disable it on prod! Off by default!
● Industry best practice: OAuth 2.0
○ Recommended to use UAA client
○ Perform scope-checking against Cloud Controller if designing broker for
Cloud Foundry
○ Don’t share UAA clients; issue one per service instance
○ Response headers should follow RFC 6750 guidelines for displaying
bearer token validation outcome. tools.ietf.org/html/rfc6750

35. Unless otherwise indicated, these slides are © 2013-2019 Pivotal Software, Inc. and licensed under a Creative Commons Attribution-NonCommercial license: http://creativecommons.org/licenses/by-nc/3.0/
Basic auth is not auth 🌶
● Use it for testing, but disable it on prod! Off by default!
● Industry best practice: OAuth 2.0
○ Recommended to use UAA client
○ Perform scope-checking against Cloud Controller if designing broker for
Cloud Foundry
○ Don’t share UAA clients; issue one per service instance
○ Response headers should follow RFC 6750 guidelines for displaying
bearer token validation outcome. tools.ietf.org/html/rfc6750
○ Don’t permit “none” as an input for token validation method

36. Unless otherwise indicated, these slides are © 2013-2019 Pivotal Software, Inc. and licensed under a Creative Commons Attribution-NonCommercial license: http://creativecommons.org/licenses/by-nc/3.0/
Sanitize all user inputs
● Inputs to admin dashboards
● Beware SQL injections

37. Unless otherwise indicated, these slides are © 2013-2019 Pivotal Software, Inc. and licensed under a Creative Commons Attribution-NonCommercial license: http://creativecommons.org/licenses/by-nc/3.0/
Sanitize all user inputs
● Inputs to admin dashboards
● Beware SQL injections
● Service instance creation request accepts arbitrary configuration JSON
cf create-service mysql large mysql-staging -c ‘{“some”: “text”}’

38. Unless otherwise indicated, these slides are © 2013-2019 Pivotal Software, Inc. and licensed under a Creative Commons Attribution-NonCommercial license: http://creativecommons.org/licenses/by-nc/3.0/
Sanitize all user inputs
● Inputs to admin dashboards
● Beware SQL injections
● Service instance creation request accepts arbitrary configuration JSON
cf create-service mysql large mysql-staging -c ‘{“some”: “text”}’
● Don’t forget URI parameters!
Loggregator CVE-2016-2165:
GET
http://loggregator-controller-uri/
<script>window.alert(“yo”)</script>

39. Unless otherwise indicated, these slides are © 2013-2019 Pivotal Software, Inc. and licensed under a Creative Commons Attribution-NonCommercial license: http://creativecommons.org/licenses/by-nc/3.0/
Encryption at rest & in-flight
In-flight:
○ Use TLS for process-to-process
communication
○ Perform hostname verification
○ Be careful with proxies; use only one
localhost for each unencrypted
process

40. Unless otherwise indicated, these slides are © 2013-2019 Pivotal Software, Inc. and licensed under a Creative Commons Attribution-NonCommercial license: http://creativecommons.org/licenses/by-nc/3.0/
Encryption at rest & in-flight
At rest:
● Leverage encryption features that
ship with the underlying software
if possible
● Provide guidance for enabling
disk encryption
In-flight:
○ Use TLS for process-to-process
communication
○ Perform hostname verification
○ Be careful with proxies; use only one
localhost for each unencrypted
process

41. Unless otherwise indicated, these slides are © 2013-2019 Pivotal Software, Inc. and licensed under a Creative Commons Attribution-NonCommercial license: http://creativecommons.org/licenses/by-nc/3.0/
Service binding secrets management
Bindings contain lots of sensitive information that should never be persisted in
plaintext.

42. Unless otherwise indicated, these slides are © 2013-2019 Pivotal Software, Inc. and licensed under a Creative Commons Attribution-NonCommercial license: http://creativecommons.org/licenses/by-nc/3.0/
Service binding secrets management
Bindings contain lots of sensitive information that should never be persisted in
plaintext.
Store these credentials in secrets managers, and build your broker to handle
variable resolution when processing requests from the application platform.

43. Unless otherwise indicated, these slides are © 2013-2019 Pivotal Software, Inc. and licensed under a Creative Commons Attribution-NonCommercial license: http://creativecommons.org/licenses/by-nc/3.0/
Be aware of service binding side effects
When application developers remove bindings, don’t forget to clean up everything
that was created as part of issuing a new service binding.
Examples:
● Open database connections
● Temporary users and groups
● Temporary files, directories, mounts
● Credentials and configuration files left behind on disk
● Artifacts in external components like credential stores, Kubernetes, etc.

44. Unless otherwise indicated, these slides are © 2013-2019 Pivotal Software, Inc. and licensed under a Creative Commons Attribution-NonCommercial license: http://creativecommons.org/licenses/by-nc/3.0/
Use automation to fight leaky credentials

45. Unless otherwise indicated, these slides are © 2013-2019 Pivotal Software, Inc. and licensed under a Creative Commons Attribution-NonCommercial license: http://creativecommons.org/licenses/by-nc/3.0/
Use BOSH Process Manager (BPM)
BOSH processes are currently not containerized. The BPM release offers some
security improvements by wrapping each monit-managed process with namespace
isolation, so they at least can’t see each other while they’re living on the same VM.
This offers protection from malicious software packaged in releases that you don’t
author as well as unintended side effects between processes.
https://bosh.io/docs/bpm/bpm/
https://github.com/cloudfoundry/bpm-release

46. Unless otherwise indicated, these slides are © 2013-2019 Pivotal Software, Inc. and licensed under a Creative Commons Attribution-NonCommercial license: http://creativecommons.org/licenses/by-nc/3.0/
To share, or not to share? [Cloud Foundry]
Cloud Foundry optionally lets service authors indicate if instances created by their
brokers are shareable. This means users across different Cloud Foundry spaces can
have their applications read/write to the same service instance.
The amount of complexity involved in engineering for security when sharing
instances entirely depends on the software you are packaging. One way to mitigate
risk is to make shared bindings read-only.
https://docs.cloudfoundry.org/devguide/services/sharing-instances.html

47. Unless otherwise indicated, these slides are © 2013-2019 Pivotal Software, Inc. and licensed under a Creative Commons Attribution-NonCommercial license: http://creativecommons.org/licenses/by-nc/3.0/
Service Broker Security
Part III:
Processes & Practices

48. Unless otherwise indicated, these slides are © 2013-2019 Pivotal Software, Inc. and licensed under a Creative Commons Attribution-NonCommercial license: http://creativecommons.org/licenses/by-nc/3.0/
Continuous Delivery
4
8

49. Unless otherwise indicated, these slides are © 2013-2019 Pivotal Software, Inc. and licensed under a Creative Commons Attribution-NonCommercial license: http://creativecommons.org/licenses/by-nc/3.0/
Reduce your “time to market” for CVE response
● Building safe and sustainable processes for
delivering changes in your software to end
users

50. Unless otherwise indicated, these slides are © 2013-2019 Pivotal Software, Inc. and licensed under a Creative Commons Attribution-NonCommercial license: http://creativecommons.org/licenses/by-nc/3.0/
Reduce your “time to market” for CVE response
● Building safe and sustainable processes for
delivering changes in your software to end
users
● Automate testing, deployment, and release
processes as much as possible

51. Unless otherwise indicated, these slides are © 2013-2019 Pivotal Software, Inc. and licensed under a Creative Commons Attribution-NonCommercial license: http://creativecommons.org/licenses/by-nc/3.0/
Reduce your “time to market” for CVE response
● Building safe and sustainable processes for
delivering changes in your software to end
users
● Automate testing, deployment, and release
processes as much as possible
● Build and deploy constantly in small batches, so
“emergency patches” have the same cycle time
as your normal release process

52. Unless otherwise indicated, these slides are © 2013-2019 Pivotal Software, Inc. and licensed under a Creative Commons Attribution-NonCommercial license: http://creativecommons.org/licenses/by-nc/3.0/
Applying Continuous Delivery principles to your
release engineering processes ensures that
“CVE Patch Weeks” are no different from
normal weeks for your engineering teams.

53. Unless otherwise indicated, these slides are © 2013-2019 Pivotal Software, Inc. and licensed under a Creative Commons Attribution-NonCommercial license: http://creativecommons.org/licenses/by-nc/3.0/
Culture & education
5
3

54. Unless otherwise indicated, these slides are © 2013-2019 Pivotal Software, Inc. and licensed under a Creative Commons Attribution-NonCommercial license: http://creativecommons.org/licenses/by-nc/3.0/
Grow a healthy security-minded culture
Building a culture around good security practices requires psychological safety to
be curious and ask questions. Without a positive, growth-oriented mindset towards
security, many organisations will default to operating on fear and/or bureaucracy.

55. Unless otherwise indicated, these slides are © 2013-2019 Pivotal Software, Inc. and licensed under a Creative Commons Attribution-NonCommercial license: http://creativecommons.org/licenses/by-nc/3.0/
Grow a healthy security-minded culture
Building a culture around good security practices requires psychological safety to
be curious and ask questions. Without a positive, growth-oriented mindset towards
security, many organisations will default to operating on fear and/or bureaucracy.
How do you start building this culture?

56. Unless otherwise indicated, these slides are © 2013-2019 Pivotal Software, Inc. and licensed under a Creative Commons Attribution-NonCommercial license: http://creativecommons.org/licenses/by-nc/3.0/
Grow a healthy security-minded culture
Building a culture around good security practices requires psychological safety to
be curious and ask questions. Without a positive, growth-oriented mindset towards
security, many organisations will default to operating on fear and/or bureaucracy.
How do you start building this culture?
● Make it easy to contact the right people. Ex. security@pivotal.io

57. Unless otherwise indicated, these slides are © 2013-2019 Pivotal Software, Inc. and licensed under a Creative Commons Attribution-NonCommercial license: http://creativecommons.org/licenses/by-nc/3.0/
Grow a healthy security-minded culture
Building a culture around good security practices requires psychological safety to
be curious and ask questions. Without a positive, growth-oriented mindset towards
security, many organisations will default to operating on fear and/or bureaucracy.
How do you start building this culture?
● Make it easy to contact the right people. Ex. security@pivotal.io
● Form a team to triage security issues and build shared tooling, and iteratively
evolve this team’s remit and responsibilities

58. Unless otherwise indicated, these slides are © 2013-2019 Pivotal Software, Inc. and licensed under a Creative Commons Attribution-NonCommercial license: http://creativecommons.org/licenses/by-nc/3.0/
Grow a healthy security-minded culture
Building a culture around good security practices requires psychological safety to
be curious and ask questions. Without a positive, growth-oriented mindset towards
security, many organisations will default to operating on fear and/or bureaucracy.
How do you start building this culture?
● Make it easy to contact the right people. Ex. security@pivotal.io
● Form a team to triage security issues and build shared tooling, and iteratively
evolve this team’s remit and responsibilities
● Develop and socialize processes that promote security education at scale
Recommended viewing: Molly Crowther, “Healthy Agile Security Culture”, S1P 2017

59. Unless otherwise indicated, these slides are © 2013-2019 Pivotal Software, Inc. and licensed under a Creative Commons Attribution-NonCommercial license: http://creativecommons.org/licenses/by-nc/3.0/
Threat Modeling workshops
Hands-on workshops that involve a whole team are a great tool for continuous
education. One model is STRIDE, developed by Microsoft.
Spoofing
Tampering
Repudiation
Information disclosure
Denial of service
Elevation of privilege

60. Unless otherwise indicated, these slides are © 2013-2019 Pivotal Software, Inc. and licensed under a Creative Commons Attribution-NonCommercial license: http://creativecommons.org/licenses/by-nc/3.0/
Threat Modeling workshops
Step One:
Team agrees on architectural diagram of
system under discussion. Decide any
components to descope, because the
team cannot directly influence near-term
development roadmap. One person
creates a clean visualisation.

61. Unless otherwise indicated, these slides are © 2013-2019 Pivotal Software, Inc. and licensed under a Creative Commons Attribution-NonCommercial license: http://creativecommons.org/licenses/by-nc/3.0/
Threat Modeling workshops
Step Two:
Introduce (or review) what each letter of STRIDE stands for.
Resources:
● Adam Shostack, Microsoft
“Elevation of Privilege: The easy way to threat model.”
youtube.com/watch?v=vEqu5fk9rlE
● Nataliya Shevchenko, “Threat Modeling: 12 Available Methods”.
insights.sei.cmu.edu/sei_blog/2018/12/threat-modeling-12-available-
methods.html

62. Unless otherwise indicated, these slides are © 2013-2019 Pivotal Software, Inc. and licensed under a Creative Commons Attribution-NonCommercial license: http://creativecommons.org/licenses/by-nc/3.0/
Threat Modeling workshops
Step Three:
Brainstorm specific scenarios that could
happen within each category of threats.
Discuss the viability of each one, and if it
seems high-risk and addressable, record
an action for the team to prioritize a fix
alongside regular backlog work.
(You can use premade scenarios if you’re
using STRIDE -- look up the “Elevation of
Privilege” card game!)
Art from MIcrosoft’s “Elevation of Privilege” threat modeling game:
https://www.microsoft.com/en-
ca/download/details.aspx?id=20303

63. Unless otherwise indicated, these slides are © 2013-2019 Pivotal Software, Inc. and licensed under a Creative Commons Attribution-NonCommercial license: http://creativecommons.org/licenses/by-nc/3.0/
In summary:
● Design and deploy brokers with security in mind
● Prioritize and implement “easy wins” for security best
practice
● Build a security-minded culture to keep improving and
learning

64. Unless otherwise indicated, these slides are © 2013-2019 Pivotal Software, Inc. and licensed under a Creative Commons Attribution-NonCommercial license: http://creativecommons.org/licenses/by-nc/3.0/
Thank you to…
Aram Price
Chris Brown
Molly Crowther
Emily Foster
Chris Piraino
Jatin Naik
Derik Evangelista
Raymond Lee
David Stevenson
Matt McNeeney

65. Stay Connected.
Slides: deniseyu.io/secure-brokers
@deniseyu21
#springone@s1p