Understanding Microservices Security Challenges
Presentation by Travis and David at the Dallas OWASP chapter delves into the intricacies of securing microservices architecture, highlighting common issues, diverse technologies, and key components. With tech giants like Amazon and Netflix already onboard, organizations are navigating the unique security concerns posed by microservices' distributed nature and varied technologies landscape.
Download Presentation
Please find below an Image/Link to download the presentation.
The content on the website is provided AS IS for your information and personal use only. It may not be sold, licensed, or shared on other websites without obtaining consent from the author. Download presentation by click this link. If you encounter any issues during the download, it is possible that the publisher has removed the file from their server.
E N D
Presentation Transcript
Microservices What Exactly Am I Securing Again? A presentation where Travis and David talk to the Dallas OWASP chapter about microservices architecture.
Intros Travis Biehn David Bohannon Synopsys, Inc
Agenda Overview of Microservices Common Problems What Now? Questions
Background Tech giants Amazon and Netflix have embraced Microservice architecture for over a decade Other organizations are following suite as they realize the benefits Technological independence Scalability and redundancy Reusability CI/CD compatibility Microservices exhibit unique problems not seen in monolithic applications
New Business Interesting technologies and protocols require SMEs 87% use multiple technologies within their microservices Examples include Thrift, Protocol Buffers, AMQP, Kafka, GraphQL, etc. Mis-matched with existing security tooling More to look at Increased network presence and additional platforms, gateways, circuit breakers, etc. Interesting deployment models Infrastructure as code, container management, etc.
Components Microservices Services Composition (API Gateway) Orchestration Service Registry Circuit Breaker
Territory Service Providers AWS Lambda and API Gateway Google App Engine Microsoft Azure Kubernetes Services Technologies Containerization (Kubernetes, Docker) Message Queueing (AMQP, MQTT, Kafka, etc.) Synchronous Communication (REST, Thrift, XML-RPC, GraphQL, etc.) Service Discovery (SmartStack, Zookeeper, Etcd, Consul, NSQ, Serf, and Doozer, Eureka) Orchestration (Azure Service Fabric, Azure Kubernetes Service, Netflix Conductor, etc.)
Concepts Monolithic application functionality is invoked internally.
Concepts Microservices each services is invoked via network call.
Securing Access to Services https://csrc.nist.gov/publications/detail/sp/800-204/draft
M&M Security Hard external surface with a soft, vulnerable middle
Testing is Difficult Because We often do not know who is using the service Lack of support for unique protocols/technologies Inability of tools to follow flows across services Increased attack surface compared to monolithic applications Calling services directly Middling network communications Attacking containerization technologies Attacking registration services Etc
Mutual TLS A partial solution preventing attackers from accessing services directly Use Mutual TLS to ensure only expected clients connect to services = mTLS
SAST Tooling Difficult for SAST tools to follow data flows across services VS.
Weird Message Formats Difficult for dynamic tooling and security testers to manipulate uncommon/unsupported protocols VS.
The Problem We are speaking GraphQL
Pub-Sub Communications So, what are you doing later today? Nothing much, you?
Pub-Sub Communications https://aws.amazon.com/pub-sub-messaging/
Pub-Sub Communications Microservices pub-sub architecture and the mailbox analogy
Pub-Sub Communications Manipulating messages
Orchestration Responsible for ensuring there are enough concrete instances to serve the requests Possesses complete control over the service instances, making it a valuable target
Service Registry I m a new service at 10.0.2.6 I m a new service at 10.0.2.7 I m a new service at 10.0.2.5 Hey, discovery server! Where can I access the ManageWidgets service??? Hey, discovery server! I m a new instance of the billing service at 10.0.3.5 send sensitive billing info to me! You can access the ManageWidgets service at 10.0.2.5, 10.0.2.6, or 10.0.2.7
Monitoring In a monolithic application. I m still up and running all is good here. No problems here either.
Im still up and running all is good here. Monitoring in a microservices architecture. No problems here either. No problems here either. I m still up and running all is good here. I m still up and running all is good here. I m still up and running all is good here. I m still up and running all is good here. I m still up and running all is good here. I m still up and running all is No problems here either. good here. No problems here either.
Monitoring Difficulty correlating inbound requests to services that handle the request VS.
Monitoring A few helpful tools https://netflix.github.io/ Repo containing many open-source tools including some of Netflix monitoring solutions Includes the famous Simian Army and Chaos Monkey used to test resilience and monitoring capabilities
So What Microservices are here to stay. Evaluate all the new things. Turn PDFs and governance into code. Help develop security features. Push the tools.
Drop us a note tbiehn@synopsys.com bohannon@synopsys.com
