AppSec And Microservices

•

3 likes•4,412 views

Microservices give us many options. We can pick different technologies, mix synchronous and asynchronous integration techniques or embrace different deployment patterns. But they also give us different options in how we think about securing our systems. Done right, and microservices can increase the security of your vital data and processes. Done wrong, and you can increase the surface area of attack. This talk will discuss the importance of defence in depth, discussing the many different ways in which you can secure your fine-grained, distributed architectures.

Technology

APPSEC AND
MICROSERVICES
Sam Newman
O’Reilly Software Architecture Conference, NYC 2016

@samnewmanhttps://www.ﬂickr.com/photos/seattlemunicipalarchives/4058808950

@samnewmanhttps://www.ﬂickr.com/photos/theseanster93/485390997/

@samnewman
Accounts
Returns
Invoicing
Shipping
Inventory
Customer
Service

@samnewman
Accounts
Returns
Invoicing
Shipping
Inventory
Customer
Service
Small Autonomous services that
work together, modelled around
a business domain

https://www.ﬂickr.com/photos/wwworks/2607036664/

https://www.ﬂickr.com/photos/lkowen/15803718243/

@samnewman
Prevention Detection
Response

@samnewman
Prevention Detection
ResponseRecovery

@samnewmanhttps://www.ﬂickr.com/photos/adulau/15680439035/

@samnewmanhttps://www.ﬂickr.com/photos/duanestorey/469163789/

@samnewman
https://www.schneier.com/paper-attacktrees-ddj-ft.html

@samnewman
Open Safe
Pick Lock Learn Combo Cut Open

@samnewman
Open Safe
Pick Lock Learn Combo Cut Open
Find Written
Combo
Get Combo from
the target

@samnewman
Open Safe
Pick Lock Learn Combo Cut Open
Find Written
Combo
Get Combo from
the target
Blackmail Threaten Bribe

@samnewman
Open Safe
Pick Lock Learn Combo Cut Open
Find Written
Combo
Get Combo from
the target
Blackmail Threaten Bribe
Impossible
Impossible Impossible
Possible
Possible
Possible

@samnewman
Catalog
service
Music
Web Shop
Recommend
service
Royalty
Payment
Gateway
Mobile
app
Web
browsers
User
service

@samnewman
Catalog
service
Music
Web Shop
Recommend
service
Royalty
Payment
Gateway
Mobile
app
Web
browsers
User
service
Transport Security

BENEFITS OF HTTPS?
▫︎Server guarantees!
▫︎Payload not manipulated…

BENEFITS OF HTTPS?
▫︎Server guarantees!
▫︎Payload not manipulated…
▫︎…but no client guarantee and…

BENEFITS OF HTTPS?
▫︎Server guarantees!
▫︎Payload not manipulated…
▫︎…but no client guarantee and…
▫︎…certiﬁcates can be a pain

Catalog
service
Music
Web Shop
Recommend
service
Royalty
Payment
Gateway
Mobile
app
Web
browsers
User
service

CLIENT-SIDE CERTIFICATES?
▫︎Client guarantees!

CLIENT-SIDE CERTIFICATES?
▫︎Client guarantees!
▫︎…but a PITA to manage….

@samnewman
http://techblog.netﬂix.com/2015/09/introducing-lemur.html

@samnewman
Catalog
service
Music
Web Shop
Recommend
service
Royalty
Payment
Gateway
Mobile
app
Web
browsers
User
service
Web
browsers
Form AuthOAuth

@samnewman
Catalog
service
Music
Web Shop
Recommend
service
Royalty
Payment
Gateway
Mobile
app
Web
browsers
User
service
User
service

@samnewman
https://www.qualys.com/research/top10/

@samnewman
Catalog
service
Music
Web Shop
Recommend
service
Royalty
service
Mobile
app
Web
browsers
User
service

@samnewman
Catalog
service
Music
Web Shop
Recommend
service
Royalty
service
Mobile
app
Web
browsers
User
service
PERIMITER SECURITY!

@samnewman
Polyglot = more stuﬀ to track!

@samnewman
Polyglot = more things to break?

@samnewmanhttp://krebsonsecurity.com/tag/target-data-breach/

@samnewman
https://en.wikipedia.org/wiki/Chicago_Tylenol_murders

@samnewman
Backups
Burn it all down
Harder with microservices?

@samnewman
Sam Newman
Building
Microservices
DESIGNING FINE-GRAINED SYSTEMS
http://buildingmicroservices.com/

@samnewman
Sam Newman
Building
Microservices
DESIGNING FINE-GRAINED SYSTEMS
http://buildingmicroservices.com/
http://samnewman.io/

@samnewman
Sam Newman
Building
Microservices
DESIGNING FINE-GRAINED SYSTEMS
http://buildingmicroservices.com/
http://magpietalkshow.com/
http://samnewman.io/

@samnewman
snewman@thoughtworks.com
THANKS!

What's hot

Practical microservices - YOW 2013Sam Newman

Confusion In The Land Of The ServerlessSam Newman

Deploying and Scaling MicroservicesSam Newman

What Is This Cloud Native Thing Anyway?Sam Newman

Testing & deploying microservices - XP Days Ukraine 2014Sam Newman

It's a trap!Sam Newman

Principles of Microservices - NDC 2014Sam Newman

From macro to micro gotoSam Newman

Principles of microservices ndc osloSam Newman

Hiding The Lead: Coupling, cohesion and microservicesSam Newman

Rip It Up - The Microservice OrganisationSam Newman

THE UX OF DATA - VISUALIZATION RESPONSIVEPeter Rozek

Taking the P out of PWAChristian Heilmann

The UX of DATA: Responsive Datenvisualisierung mit jQueryPeter Rozek

Keynote: Sam Newman, Building Microservices | The Tyranny Of Data | Kafka Sum...HostedbyConfluent

Networks, Networks Everywhere, And Not A Packet To DrinkReadWrite

Performance and UXPeter Rozek

Deploying and Testing MicroservicesThoughtworks

Getting amped for ampSeagyn Davis

A (Story Map) is worth a thousand wordsElliot Susel

What's hot (20)

Practical microservices - YOW 2013

Confusion In The Land Of The Serverless

Deploying and Scaling Microservices

What Is This Cloud Native Thing Anyway?

Testing & deploying microservices - XP Days Ukraine 2014

It's a trap!

Principles of Microservices - NDC 2014

From macro to micro goto

Principles of microservices ndc oslo

Hiding The Lead: Coupling, cohesion and microservices

Rip It Up - The Microservice Organisation

THE UX OF DATA - VISUALIZATION RESPONSIVE

Taking the P out of PWA

The UX of DATA: Responsive Datenvisualisierung mit jQuery

Keynote: Sam Newman, Building Microservices | The Tyranny Of Data | Kafka Sum...

Networks, Networks Everywhere, And Not A Packet To Drink

Performance and UX

Deploying and Testing Microservices

Getting amped for amp

A (Story Map) is worth a thousand words

Viewers also liked

ELK: Moose-ively scaling your log systemAvleen Vig

Principles of microservices velocitySam Newman

Launching a Rocketship Off Someone Else's Backjoshelman

An Authentication and Authorization Architecture for a Microservices WorldVMware Tanzu

Are microservices 'soa done right'?Jason Bloomberg

App::highlight - a simple grep-like highlighter appAlex Balhatchet

BlinkDB 紹介Masafumi Oyamada

The "Why", "What" and "How" of Microservices INPAY

Mysql casual talks vol4matsuo kenji

Enabling Microservices @Orbitz - Velocity Conf 2015Steve Hoffman

Continuous Delivery for Microservice Architectures with Concourse & Cloud Fou...VMware Tanzu

Salesforceでの大規模データの取り扱いSalesforce Developers Japan

Microservices Manchester: Security, Microservces and Vault by Nicki WattOpenCredo

サンタクロースを支えるIT技術 @M_Ishikawa #yapcasiaMasayuki Ishikawa

[D14] MySQL 5.6時代のパフォーマンスチューニング　*db tech showcase 2013 Tokyoyoyamasaki

【初公開】チャットワーク検索機能を支える技術Yoshinori Fujiwara

Lean Customer Development と顧客インタビュー (技術者/研究者発スタートアップのためのリーンスタートアップ)Takaaki Umada

人間と話す: Lean Customer Development (Lean Startup Update 2015)Takaaki Umada

Introduction to MicroservicesAmazon Web Services

Viewers also liked (19)

ELK: Moose-ively scaling your log system

Principles of microservices velocity

Launching a Rocketship Off Someone Else's Back

An Authentication and Authorization Architecture for a Microservices World

Are microservices 'soa done right'?

App::highlight - a simple grep-like highlighter app

BlinkDB 紹介

The "Why", "What" and "How" of Microservices

Mysql casual talks vol4

Enabling Microservices @Orbitz - Velocity Conf 2015

Continuous Delivery for Microservice Architectures with Concourse & Cloud Fou...

Salesforceでの大規模データの取り扱い

Microservices Manchester: Security, Microservces and Vault by Nicki Watt

サンタクロースを支えるIT技術 @M_Ishikawa #yapcasia

[D14] MySQL 5.6時代のパフォーマンスチューニング　*db tech showcase 2013 Tokyo

【初公開】チャットワーク検索機能を支える技術

Lean Customer Development と顧客インタビュー (技術者/研究者発スタートアップのためのリーンスタートアップ)

人間と話す: Lean Customer Development (Lean Startup Update 2015)

Introduction to Microservices

Similar to AppSec And Microservices

Mobile Sector analysis Pritam Raha Roy

PyconUK: Fast and Beautiful ImagesDoug Sillars

Parisjs fastvideoandimagesDoug Sillars

2019 06-25 - integrate 2019 US/UK - Sandro Pereira - BizTalk Server Fast and ...Sandro Pereira

Fast and Beautiful Images: PyConWebDoug Sillars

Common mistakes in serverless adoptionYan Cui

Mobile apps at work for non for profit accountants aicpaAbila

Mobile Apps at Work for Non For Profit Accountants #AICPANFPgrimesba

Sam Newman_Designing For Habitability.pdfVMware Tanzu

AMP Accelerated Mobile Pages - The Next Generation SMX London 2017 Dawn AndersonDawn Anderson MSc DigM

Notts js fastandbeautifulDoug Sillars

A Laugh RIAt -- OWASP 2009 Web 2.0 TalkRafal Los

Best Practices and Advanced Insights on Browser RUM Users - AppSphere16AppDynamics

City as Operating SystemAdrian McEwen

Theres a better way to do business in our IndustryCarlos BullynationTv

How to implement microservicesMarc Cluet

How to implement Micro-Services - Marc CluetOutlyer

Beautiful and Fast Images Doug Sillars

Waterford fast imagesDoug Sillars

Marcin Treder - The User Experience Design Process. The Story of Multiplayer ...Marcin Treder

Similar to AppSec And Microservices (20)

Mobile Sector analysis

PyconUK: Fast and Beautiful Images

Parisjs fastvideoandimages

2019 06-25 - integrate 2019 US/UK - Sandro Pereira - BizTalk Server Fast and ...

Fast and Beautiful Images: PyConWeb

Common mistakes in serverless adoption

Mobile apps at work for non for profit accountants aicpa

Mobile Apps at Work for Non For Profit Accountants #AICPANFP

Sam Newman_Designing For Habitability.pdf

AMP Accelerated Mobile Pages - The Next Generation SMX London 2017 Dawn Anderson

Notts js fastandbeautiful

A Laugh RIAt -- OWASP 2009 Web 2.0 Talk

Best Practices and Advanced Insights on Browser RUM Users - AppSphere16

City as Operating System

Theres a better way to do business in our Industry

How to implement microservices

How to implement Micro-Services - Marc Cluet

Beautiful and Fast Images

Waterford fast images

Marcin Treder - The User Experience Design Process. The Story of Multiplayer ...

Recently uploaded

Transcript: New from BookNet Canada for 2024: BNC CataList - Tech Forum 2024BookNet Canada

Passkey Providers and Enabling Portability: FIDO Paris Seminar.pptxLoriGlavin3

Artificial intelligence in cctv survelliance.pptxhariprasad279825

Transcript: New from BookNet Canada for 2024: Loan Stars - Tech Forum 2024BookNet Canada

Generative AI for Technical Writer or Information DevelopersRaghuram Pandurangan

Gen AI in Business - Global Trends Report 2024.pdfAddepto

New from BookNet Canada for 2024: BNC CataList - Tech Forum 2024BookNet Canada

What is DBT - The Ultimate Data Build Tool.pdfMounikaPolabathina

Time Series Foundation Models - current state and future directionsNathaniel Shimoni

"Subclassing and Composition – A Pythonic Tour of Trade-Offs", Hynek SchlawackFwdays

SALESFORCE EDUCATION CLOUD | FEXLE SERVICESmohitsingh558521

Moving Beyond Passwords: FIDO Paris Seminar.pdfLoriGlavin3

A Deep Dive on Passkeys: FIDO Paris Seminar.pptxLoriGlavin3

Merck Moving Beyond Passwords: FIDO Paris Seminar.pptxLoriGlavin3

How AI, OpenAI, and ChatGPT impact business and software.Curtis Poe

unit 4 immunoblotting technique complete.pptxBkGupta21

"Debugging python applications inside k8s environment", Andrii SoldatenkoFwdays

A Journey Into the Emotions of Software DevelopersNicole Novielli

Unraveling Multimodality with Large Language Models.pdfAlex Barbosa Coqueiro

"ML in Production",Oleksandr BaganFwdays

Recently uploaded (20)

Transcript: New from BookNet Canada for 2024: BNC CataList - Tech Forum 2024

Passkey Providers and Enabling Portability: FIDO Paris Seminar.pptx

Artificial intelligence in cctv survelliance.pptx

Transcript: New from BookNet Canada for 2024: Loan Stars - Tech Forum 2024

Generative AI for Technical Writer or Information Developers

Gen AI in Business - Global Trends Report 2024.pdf

New from BookNet Canada for 2024: BNC CataList - Tech Forum 2024

What is DBT - The Ultimate Data Build Tool.pdf

Time Series Foundation Models - current state and future directions

"Subclassing and Composition – A Pythonic Tour of Trade-Offs", Hynek Schlawack

SALESFORCE EDUCATION CLOUD | FEXLE SERVICES

Moving Beyond Passwords: FIDO Paris Seminar.pdf

A Deep Dive on Passkeys: FIDO Paris Seminar.pptx

Merck Moving Beyond Passwords: FIDO Paris Seminar.pptx

How AI, OpenAI, and ChatGPT impact business and software.

unit 4 immunoblotting technique complete.pptx

"Debugging python applications inside k8s environment", Andrii Soldatenko

A Journey Into the Emotions of Software Developers

Unraveling Multimodality with Large Language Models.pdf

"ML in Production",Oleksandr Bagan

AppSec And Microservices

1. APPSEC AND MICROSERVICES Sam Newman O’Reilly Software Architecture Conference, NYC 2016

2. @samnewman

3. @samnewman

4. @samnewmanhttps://www.ﬂickr.com/photos/seattlemunicipalarchives/4058808950

5. @samnewmanhttps://www.ﬂickr.com/photos/theseanster93/485390997/

6. @samnewman http://map.norsecorp.com/

7. @samnewman

8. @samnewman

9. @samnewman Accounts Returns Invoicing Shipping Inventory Customer Service

10. @samnewman Accounts Returns Invoicing Shipping Inventory Customer Service Small Autonomous services that work together, modelled around a business domain

11. https://www.ﬂickr.com/photos/wwworks/2607036664/

12. https://www.ﬂickr.com/photos/lkowen/15803718243/

13. @samnewman

14. @samnewman

15. @samnewman

16. @samnewman

17. @samnewman

18. @samnewman Prevention

19. @samnewman Prevention Detection

20. @samnewman Prevention Detection Response

21. @samnewman Prevention Detection ResponseRecovery

22. @samnewman Prevention Detection ResponseRecovery

23. @samnewman Prevention Detection ResponseRecovery

24. @samnewmanhttps://www.ﬂickr.com/photos/adulau/15680439035/

25. @samnewmanhttps://www.ﬂickr.com/photos/duanestorey/469163789/

26. @samnewman https://www.schneier.com/paper-attacktrees-ddj-ft.html

27. @samnewman Open Safe

28. @samnewman Open Safe Pick Lock Learn Combo Cut Open

29. @samnewman Open Safe Pick Lock Learn Combo Cut Open Find Written Combo Get Combo from the target

30. @samnewman Open Safe Pick Lock Learn Combo Cut Open Find Written Combo Get Combo from the target Blackmail Threaten Bribe

31. @samnewman Open Safe Pick Lock Learn Combo Cut Open Find Written Combo Get Combo from the target Blackmail Threaten Bribe Impossible Impossible Impossible Possible Possible Possible

32. @samnewman Catalog service Music Web Shop Recommend service Royalty Payment Gateway Mobile app Web browsers User service

33. @samnewman Catalog service Music Web Shop Recommend service Royalty Payment Gateway Mobile app Web browsers User service Transport Security

34. @samnewman HTTPS Everywhere!

35. BENEFITS OF HTTPS?

36. BENEFITS OF HTTPS? ▫︎Server guarantees!

37. BENEFITS OF HTTPS? ▫︎Server guarantees! ▫︎Payload not manipulated…

38. BENEFITS OF HTTPS? ▫︎Server guarantees! ▫︎Payload not manipulated… ▫︎…but no client guarantee and…

39. BENEFITS OF HTTPS? ▫︎Server guarantees! ▫︎Payload not manipulated… ▫︎…but no client guarantee and… ▫︎…certiﬁcates can be a pain

40. @samnewman https://letsencrypt.org/

41. @samnewman

42. Catalog service Music Web Shop Recommend service Royalty Payment Gateway Mobile app Web browsers User service

43. CLIENT-SIDE CERTIFICATES?