Microservices – What Exactly Am I Securing Again? A presentation where Travis and David talk to the Dallas OWASP chapter about microservices architecture.

Intros Travis Biehn David Bohannon Synopsys, Inc

Agenda Overview of Microservices Common Problems What Now? Questions

Background Tech giants Amazon and Netflix have embraced Microservice architecture for over a decade Other organizations are following suite as they realize the benefits Technological independence Scalability and redundancy Reusability CI/CD compatibility Microservices exhibit unique problems not seen in monolithic applications

New Business Interesting technologies and protocols require SMEs 87% use multiple technologies within their microservices Examples include Thrift, Protocol Buffers, AMQP, Kafka, GraphQL, etc. Mis-matched with existing security tooling More to look at Increased network presence and additional platforms, gateways, circuit breakers, etc. Interesting deployment models Infrastructure as code, container management, etc.

Components Microservices Services Composition (API Gateway) Orchestration Service Registry Circuit Breaker

Territory Service Providers Technologies AWS Lambda and API Gateway Google App Engine Microsoft Azure Kubernetes Services Technologies Containerization (Kubernetes, Docker) Message Queueing (AMQP, MQTT, Kafka, etc.) Synchronous Communication (REST, Thrift, XML-RPC, GraphQL, etc.) Service Discovery (SmartStack, Zookeeper, Etcd, Consul, NSQ, Serf, and Doozer, Eureka) Orchestration (Azure Service Fabric, Azure Kubernetes Service, Netflix Conductor, etc.)

Microservices Valhalla

Valhalla, NY

Concepts Monolithic application – functionality is invoked internally.

Concepts Microservices – each services is invoked via network call.

Securing Access to Services https://csrc.nist.gov/publications/detail/sp/800-204/draft

M&M Security Hard external surface with a soft, vulnerable middle…

Testing is Difficult Because… We often do not know who is using the service Lack of support for unique protocols/technologies Inability of tools to follow flows across services Increased attack surface compared to monolithic applications Calling services directly Middling network communications Attacking containerization technologies Attacking registration services Etc …

Use Mutual TLS to ensure only expected clients connect to services A partial solution… preventing attackers from accessing services directly Use Mutual TLS to ensure only expected clients connect to services = mTLS

SAST Tooling Difficult for SAST tools to follow data flows across services VS.

Weird Message Formats VS. Difficult for dynamic tooling and security testers to manipulate uncommon/unsupported protocols VS.

The Problem We are speaking “GraphQL”…

BurpSuite Doesn’t Speak “GraphQL”

Pub-Sub Communications So, what are you doing later today? Nothing much, you?

Pub-Sub Communications https://aws.amazon.com/pub-sub-messaging/

Pub-Sub Communications Microservices pub-sub architecture and the mailbox analogy…

Pub-Sub Communications Manipulating messages

Orchestration Responsible for ensuring there are enough concrete instances to serve the requests Possesses complete control over the service instances, making it a valuable target

Service Registry

Hey, discovery server! Where can I access the ManageWidgets service??? Service Registry I’m a new service at 10.0.2.6 I’m a new service at 10.0.2.7 I’m a new service at 10.0.2.5 Hey, discovery server! Where can I access the ManageWidgets service??? Hey, discovery server! I’m a new instance of the billing service at 10.0.3.5 – send sensitive billing info to me! You can access the ManageWidgets service at 10.0.2.5, 10.0.2.6, or 10.0.2.7

Etcd-anger

Monitoring …In a monolithic application. I’m still up and running… all is good here. No problems here either.

Monitoring …in a microservices architecture. I’m still up and running… all is good here. No problems here either. No problems here either. …in a microservices architecture. I’m still up and running… all is good here. I’m still up and running… all is good here. I’m still up and running… all is good here. I’m still up and running… all is good here. I’m still up and running… all is good here. No problems here either. I’m still up and running… all is good here. No problems here either.

Monitoring Difficulty correlating inbound requests to services that handle the request VS.

Monitoring https://netflix.github.io/ A few helpful tools… https://netflix.github.io/ Repo containing many open-source tools including some of Netflix monitoring solutions Includes the famous Simian Army and Chaos Monkey used to test resilience and monitoring capabilities

So What Microservices are here to stay. Evaluate all the new things. Turn PDFs and governance into code. Help develop security features. Push the tools.

Questions?

tbiehn@synopsys.com bohannon@synopsys.com Drop us a note tbiehn@synopsys.com bohannon@synopsys.com