Upload
kevin-gilpin
View
413
Download
0
Embed Size (px)
DESCRIPTION
Defend Your Infrastructure With Robot Identity and Authorization Consolidated end-user identity management and coarse-grained web application access control have improved security and improved enterprise agility. Managing access control for a multiplicity of backend services and data assets is the next challenge for IT and software development teams. Centralized management, tracking, and analysis of infrastructure identity and access controls is the next phase of evolution for security and compliance. A unified approach to infrastructure access control across the application tier improves organizational agility and transparency, improves development team productivity and sets up a well-defined collaboration between developers and devops. This presentation will highlight the following best practices, in the context of a recently developed real-world cloud-based data processing platform: • Management of “robot” and user identity for purposes of infrastructure management with discussion of Amazon IAM strengths and weaknesses • Management and distribution of keys, credentials, and other secrets • Dynamic and robust authorization of service-to-service and service-to-data requests • Access control as a functionality to satisfy regulatory and compliance requirements • The importance of an audit trail to optimize operational architecture and detect suspicious behavior
Citation preview
.HYLQ�*LOSLQ��-DVRQ�&DOYHUW)HEUXDU\���������
'HIHQG�\RXU�,QIUDVWUXFWXUHZLWK�5RERW�,GHQWLW\�DQG�$XWKRUL]DWLRQ
3UREOHPV�)UHTXHQWO\�6HHQ�LQ�WKH�&ORXG
2SHUDWLRQDOï /RVW�FUHGHQWLDOV���%,*�352%/(0���DFFHVV�WR�VRXUFH�FRGH��DGPLQ�ER[��RWKHU�FUHGHQWLDOV�GDWD
ï 2YHUO\�SHUPLVVLYH�FRQWUROV���HVSHFLDOO\�IRU�LQWHUQDO�,7�XVHUV
ï 3RRU�DXGLWLQJ���YHU\�IHZ�FRPSDQLHV�FDQ�UHFUHDWH�ZKDW�KDSSHQHG�IRU�D�EUHDFK���NHHS�ORJV�IRU�D�ORQJ�WLPH�RQ�VHSDUDWH�V\VWHPV
&UHGHQWLDOV�DUH�%,**(67�SUREOHP�ZLWK�$:6
$OH[�6WDPRV��$:6�UH�,QYHQW�����KWWS���ZZZ�HYHU\WDON�WY�WDONV������$PD]RQ�:HE�6HUYLFHV�UH�,QYHQW�6(&�����%XLOGLQJ�6HFXULW\�IURP�6FUDWFK�LQ�$:6
3UREOHPV�)UHTXHQWO\�6HHQ�LQ�WKH�&ORXG
,QIUDVWUXFWXUHï ,QVHFXUH�FRQWURO�SODQH���86(�66/�(9(5<:+(5(
ï $WWDFNV�IURP�LQVLGH�WKH�&RUSRUDWH�1HWZRUN
$SSOLFDWLRQï 7RR�ORRVH�ELQGLQJV���KDFN�WKH�ZHE�VHUYLFHV�GLUHFWRU\�ĺ�5(67�LQWHUIDFH�ĺ��GR�ZKDWHYHU
ï :HE�$3,�9XOQHUDELOLWLHV
ï 3RRU�XVH�RI�FU\SWRJUDSK\
$OH[�6WDPRV��$:6�UH�,QYHQW�����KWWS���ZZZ�HYHU\WDON�WY�WDONV������$PD]RQ�:HE�6HUYLFHV�UH�,QYHQW�6(&�����%XLOGLQJ�6HFXULW\�IURP�6FUDWFK�LQ�$:6
:H�+DYH�)DLOHG�<RX��/RUG�9DGHU
䕵 ([WHUQDO�YHQGRUV�H[SRVHG�DV�WKH�ZHDN�OLQN�LQ�HQWHUSULVH�VHFXULW\
䕵 7ULYLDO�SULYLOHJH�OHYHOV�H[SORLWHG�DQG�HVFDODWHG�WR�JDLQ�DFFHVV�WR�WKH�PRVW�FULWLFDO�GDWD
5LJKW�6FULSW��:URQJ�(QYLURQPHQW䕵 $:6�0DLQWHQDQFH�VFULSW�GHOHWHV�
(ODVWLF�/RDG�%DODQFHU�'%�UHFRUGV�XVHG�IRU�VHOI�PDQDJHPHQW
䕵 .DERRP��1HWIOL[�HW�DO
1DWLRQ�LV�XQDEOH�WR��ZDWFK�ê$�&KULVWPDV�&DUROë�DQG�OLYH�WKH�WUXH�PHDQLQJ�RI�&KULVWPDV
6ROXWLRQ��.HHS�7UDFN�RI�7KLQJV%H�RUJDQL]HG��DQG�
PDLQWDLQ�FRQWURO�RI�
䕵 3DVVZRUGV䕵 3ROLFLHV䕵 $FFHVV�UXOHV䕵 *URXSV�DQG�UROHV䕵 6HFXUH�FRPPXQLFDWLRQ
&ORVLQJ�WKH�ê&RPSOLDQFH�*DSë$:6�SURYLGHV� $:6�GRHV�QRW�SURYLGH�
Ɣ 3K\VLFDO�VHFXULW\
Ɣ 6RIWZDUH�GHILQHG�QHWZRUN
Ɣ 5HOLDEOH�$0,V
Ɣ :D\V�WR�VWURQJO\�SDUWLWLRQ�LQIR��HJ��DFFRXQWV�
Ɣ 'XUDELOLW\
Ɣ ,DD6�EDFNSODQH
Ɣ 0DQDJH�$:6�FUHGHQWLDOV
Ɣ 3DVVZRUGV
Ɣ $:6�SROLFLHV
Ɣ (QFU\SWLRQ�NH\V�DQG�RWKHU�VHFUHWV
Ɣ $SSOLFDWLRQ�WLHU�DXGLW
6QRZIODNHV䕵 /RWV�RI�2SWLRQV�LQ�$:6
䕵 0DQXDO�DGPLQLVWUDWLRQ�RI�WRR�PDQ\�RSWLRQV�SURGXFHV�êVQRZIODNHVë
䕵 ê6QRZIODNHV�VRRQ�EHFRPH�KDUG�WR�XQGHUVWDQG�DQG�PRGLI\ë
䕵 $SSOLHV�WR�VHUYHUV��SROLFLHV��DXWK]��DUFKLWHFWXUH��HWF�
7KHUHIRUH��DXWRPDWH��WHVW��DQG�YHULI\
KWWS���IOLF�NU�S��FYUI
'RQèW�6KRUWFXW�<RXU�:D\�LQWR�7URXEOH
0DQXDO�KDFNLQJ�LV�QRW�D�VKRUWFXW
%H�5HSURGXFLEOH
䕵 6DPH�SDFNDJHV䕵 6DPH�FRQILJXUDWLRQ
ð�DQGð
䕵 6DPH�SULYLOHJHV
&RPPRQ�3UREOHP���$XWKRUL]DWLRQ
䕵 'HIHQG�LQ�GHSWK
䕵 6LQJOH�SHULPHWHU�GHIHQVH�LV�QRW�VXIILFLHQW
䕵 $SSO\�WKH�PRVW�H[WHQVLYH�SURWHFWLRQ�WR�WKH�PRVW�YDOXDEOH�DVVHWV
KWWS���ZZZ�FVRRQOLQH�FRP�DUWLFOH��������LQIRUPDWLRQ�VHFXULW\�GHIHQVH�LQ�GHSWK�OHVVRQV�IURP�D�EURQ]H�DJH�IRUW�"SDJH �
<RXU�$XWK]�)RUWUHVV
&OLHQW�7HUPLQDO
6HFXUH0HVVDJH4XHXH
90��6HUYLFH Ɣ $OO�FORXG�FUHGHQWLDOV�DQG�,$0�SROLFLHV�DXWR�JHQHUDWHG�DQG�PDQDJHG�SURJUDPPDWLFDOO\
Ɣ $OO�LQWHUDFWLRQV�GHILQHG�DQG�UHSRUWDEOH�E\�DXWK]�SROLFLHV
Ɣ $OO�LQWHUDFWLRQV�FKHFNHG�E\�DXWK]Ɣ $OO�VHFUHWV�GLVWULEXWHG�SURJUDPPDWLFDOO\
ż &ORXG�NH\V��NH\�SDLUV��SDVVZRUGV��HWF�IHWFKHG�YLD�KXPDQ�RU�URERW�LGHQWLW\
ż �����DXWRPDWHG�NH\�SDVVZRUG�URWDWLRQ
Ɣ 6LJQHG�TXHXH�PHVVDJHVƔ (QFU\SWLRQ�LQ�WUDQVLWƔ (YHU\�LQWHUDFWLRQ�UHFRUGHG�WR�,DD6�DQG�
DSSOLFDWLRQ�DXGLW
�
�
�
�
$PD]RQ�,$0���$XWRPDWH�,W䕵 9HU\�GHWDLOHG��JUDQXODU䕵 (DV\�WR�SURSDJDWH�SULYLOHJHV�WR�
90V�YLD�,$0�5ROHV�IRU�(&�䕵 *LYHV�D�ZD\�WR�SURSDJDWH�
SULYLOHJHV�IURP�XVHUV�WR�90V䕵 &DQ�ERRWVWUDS�WR�RWKHU�SULYLOHJHV䕵 ,$0�DFWLRQV�DUH�FDSWXUHG�LQ�
&ORXG7UDLO��$:6�DXGLW�
䕵 +DUG�WR�XVH�ILQH�JUDLQHG�SHUPLVVLRQV�IRU�GHYHORSPHQW
䕵 7ULDO�DQG�HUURU䕵 1R�KLJK�OHYHO�UHSRUWLQJ�RQ�
SHUPLVVLRQV
ê:LULQJë��&RQQHFWLQJ�6\VWHPV�7RJHWKHU
(DFK�NH\�HVWDEOLVKHV�D�FRQQHFWLRQ�EHWZHHQ�WZR�DSSOLFDWLRQ�FRPSRQHQWV
$�FRPSRQHQW�ZLWKRXW�NH\V�LV�êRUSKDQHGë�DQG�KDUPOHVV���QRQ�IXQFWLRQDO
6HFUHWV��WKH�6QRZIODNH�3UREOHP
䕵 0DQXDO�FRS\LQJ�ĺ�VQRZIODNHV��ORVV
䕵 0DQXDO�SROLFLHV�ĺ�SULYLOHJH�FUHHS
0DQXDO�ĺ�HQWURS\�ĺ��IDLOXUH
&RQILJXUDWLRQ�0DQDJHPHQW�LV�QRW�.H\�0DQDJHPHQW
&RQILJXUDWLRQ�PDQDJHPHQW�PD\�)((/�OLNH�D�JRRG�ZD\�WR�GLVWULEXWH�VHFUHWV�
ð
%XW�WKLV�LV�MXVW�D�FDVH�RI�ZLHOGLQJ�D�KDPPHU�DQG�WUHDWLQJ�HYHU\WKLQJ�DV�D�QDLO
ð
&RQILJXUDWLRQ�PDQDJHPHQW�GRQèW�KDQGOH�VHFUHWV��DXWK]��RU�DXGLW�YHU\�ZHOO
&RQILJXUDWLRQ�0DQDJHPHQW�LV�&RQIXVLQJ�3HRSOH�$ERXW�6HFUHWV
&RQILJXUDWLRQ�0DQDJHPHQW�LV�QRW�.H\�0DQDJHPHQW
7ZR�RUWKRJRQDO�FRQFHUQV��� ,QVWDOO�SDFNDJHV�DQG�HVWDEOLVK�
FRQILJXUDWLRQ�VHWWLQJV
�� ê:LUH�XSë�WKH�V\VWHP�ZLWK�LGHQWLW\�DQG�VHFUHWV
6\VWHP�êZLULQJë�VKRXOG�QRW�EH�LQ�WKH�GRPDLQ�RI�FRQILJXUDWLRQ�PDQDJHPHQW
([DPSOH��&KHI
(QFU\SWHG�GDWD�EDJV�ê7KH�FKHI�FOLHQW�XVHV�VKDUHG�VHFUHW�HQFU\SWLRQë
䕵 +RZ�LV�WKH�VKDUHG�VHFUHW�GLVWULEXWHG"
䕵 <RX�VWLOO�QHHG�D�VHFUHWV�$3,��KRVW�LGHQWLW\�DQG�SHUPLVVLRQV�V\VWHP
6R�$JDLQ
&RQILJXUDWLRQ�� �6HFUHWV
6HFUHWV�LV�LWV�2ZQ�3UREOHP
,W�LV�QRW�D�VXE�FDWHJRU\�RI�&RQILJXUDWLRQ�0DQDJHPHQW�%(&$86(�LW�LV�DOO�DERXW�LGHQWLW\�DQG�DXWKRUL]DWLRQ��VHSDUDWLRQ�RI�UROHV�DQG�FRQFHUQV�
ê/HDVW�SULYLOHJHë��êVHSDUDWLRQ�RI�GXWLHVë��êDXGLWë�ĺ�DUH�WKH�NH\�UHTXLUHPHQWV
$XWRPDWH�$OO�6HFUHWV�� $VVLJQ�LGHQWLW\�WR�KRVW
�� *UDQW�SULYLOHJHV�WR�KRVW
�� )HWFK�VHFUHWV�YLD�FRPPDQG�OLQH�RU�FRQILJXUDWLRQ�PDQDJHPHQW�KHOSHU
�� %HWWHU�\HW��IHWFK�DQG�XVH�VHFUHWV�RQ�GHPDQG�DQG�NHHS�WKHP�RII�PDFKLQHV
��(VWDEOLVK�LGHQWLW\�RI�WKH�KRVW��VHFUHWV�ORJLQ��X�KRVWLG��2EWDLQ�VHFUHW��VHFUHWV�IHWFK�VWDJH�P\VTO�SDVVZRUG�!��HWF�P\VTOBSDVVZRUG
SZG� �VHFUHWV�IHWFK�´VWDJH�P\VTO�SDVVZRUGµ�WHPSODWH�´�HWF�P\VTO�FRQIµ�GR��VRXUFH�´P\VTO�FRQI�HUEµ��YDULDEOHV�SDVVZRUG��SZGHQG
,GHQWLW\�LV�WKH�)RXQGDWLRQ�RI�3HUPLVVLRQV
䕵 ,GHQWLW\�LV�WKH�PHDQV�WR�DQ�HQG䎗 &RQWURO�DQG�FHUWDLQW\
䕵 7KH�HQG�LV�JUDQWLQJ�UROHV�ZKLFK�KDYH�SULYLOHJHV
䕵 5ROH�JUDQWV�PXVW�IORZ�IURP�D�KLJKHU�DXWKRULW\
+RVW�,GHQWLW\
䕵 $:6�SURYLGHV�WUXVWHG�VRXUFH�,3
6WUHQJWKHQ�ZLWK�
䕵 &UHGHQWLDOV�ĺ�+RVW�,G�SOXV�6HFUHW
䕵 66/�PXWXDO�DXWKHQWLFDWLRQD� 'HULYH�FHUWLILFDWHV�IURP�PDVWHU�WUXVWHG�FHUW
,GHQWLW\�YLD�$XWKRULW\
䕵 ,GHQWLW\�IORZV�IURP�D�FHQWUDO�DXWKRULW\
䕵 7UXVW�LQ�WKH�DXWKRULW\�PXVW�EH�EXLOW�LQ
$Q�$XWKRULW\�IRU�$:6
䕵 $�ZHE�VHUYLFH䎗 /LNH�HYHU\WKLQJ�HOVH
䕵 ,Q�D�GHGLFDWHG�$:6�DFFRXQW䎗 6R�WKDW�WKHUH�LV�QR�ZD\�WR�DFFLGHQWDOO\�êOHDNë�SULYLOHJH�WR�DFFHVV�WKH�
DXWKRULW\�ER[
䕵 ,VVXHV�H[SLULQJ�DXWK�WRNHQV
䕵 +ROGV�D�FHUWLILFDWH�ZKLFK�LV�WUXVWHG�E\�WKH�UHVW�RI�WKH�V\VWHP
(VWDEOLVK�7UXVW�:LWK�D�&HUWLILFDWH
䕵 &UHDWH�D�êVLPSOHë�&$
䕵 %XLOG�$0,�ZLWK�HPEHGGHG�7��FHUW
䕵 $OO�\RXU�90V�ZLOO�WUXVW�WKLV�FHUW
3OXV�SURSDJDWLQJ�LGHQWLW\�RI�RULJLQDO�UHTXHVWHU
3OXV�DQ�LGHQWLW\�EDVHG�DXWK]�JDWHNHHSHU
3OXV�D�VKDUHG�VHFUHW
6HUYLFH�WR�6HUYLFH�$XWK]
$�0DWXULW\�0RGHO�IRU�$SSV�DQG�&RQWURO�3ODQH
7UXVW�HYHU\WKLQJ��UHVWULFW�WUDIILF�YLD�VHFXULW\�JURXSV 6HFXULW\�JURXS�VHWWLQJV�
FDQ�EH�PRGLILHG
$:6�,$0�%DG�%HKDYLRU�([DPSOH
䕵 /DXQFK�D�90�IURP�$:6�0DUNHWSODFH
䕵 90�UHTXHVWV�DQ�êDGPLQLVWUDWRUë�OHYHO�FUHGHQWLDO
䕵 3XVK�EDFN�WR�YHQGRU�\LHOGV�WKH�DFWXDO�SROLF\�WKDW�WKH�90�QHHGV
KWWS���IRUXP�[GD�GHYHORSHUV�FRP�VKRZWKUHDG�SKS"W ������SDJH �
$:6�,$0�%HWWHU�%HKDYLRU
%HWWHU�6ROXWLRQ䕵 90�VHWXS�VFULSW�UHTXHVWV�DQ�
DGPLQ�FUHGHQWLDO
䕵 90�FUHDWHV�DQG�VDYHV�LWV�RZQ�LGHQWLW\�DQG�PLQLPDO�SROLF\
䕵 90�êIRUJHWVë�WKH�DGPLQ�FUHGHQWLDO
$:6�,$0�%HVW�%HKDYLRU
%HVW�6ROXWLRQ䕵 9HQGRU�SURYLGHV�SROLF\
䕵 $GPLQ�FUHDWHV�,$0�UROH�DQG�DSSOLHV�SROLF\
䕵 $GPLQ�JUDQWV�WKH�,$0�UROH�WR�WKH�90
ĺ�1R�VWRUDJH�RI�FUHGHQWLDOV�RQ�GLVN
6HFXUH�WKH�&RQWURO�3ODQH
䕵 ,QYHVW�LQ�66/�IRU�\RXU�FRQWURO�SODQH�VHUYLFHV
䕵 5REXVW�DXWKQ���DXWK]�IRU�DGPLQ�DFFHVV�WR�ER[HV䎗 35,9$7(�.(<6�,668('�%<�(&��$5(�)25�(0(5*(1&<�$&&(66�
21/<
䎗 ��IDFWRU�DXWK
䎗 $XWKRUL]DWLRQ��H�J��/'$3��ZKLFK�LV�VHSDUDWH�DQG�DGGLWLRQDO�WR�DXWKHQWLFDWLRQ�PDNHV�GH�SURYLVLRQLQJ�PXFK�HDVLHU
,GHQWLW\�3URSDJDWLRQ���6WURQJHU�WKDQ�6HUYLFH�,GHQWLW\
1H[W�6HUYLFH���
8VHU�,GHQWLW\�3URSDJDWHG�WR�6HUYLFH�%
6HUYLFH�$
3ULYLOHJHG�8VHU��,GHQWLW\
5HFDS���*URXQGZRUN
�� 8VH�D�VHSDUDWH�$:6�DFFRXQW�IRU�VHFXULW\�SXUSRVHV
�� %XLOG�DQ�$0,�WR�WUXVW�WKLV�DXWKRULW\D� :LUH�XS�ORJJLQJ��PRQLWRULQJ��HWF�ZKLOH�\RX�DUH�DW�LW
�� ,VVXH�LGHQWLW\�IURP�WKLV�VHUYLFH
5HFDS���,$0
�� $XWRPDWH�WKH�JHQHUDWLRQ�RI�,$0�XVHUV��UROHV��DQG�SROLFLHV
D� &RPELQH�WKLV�ORJLF�LQWR�WHVWDEOH��UHXVDEOH��VHFXUH�PRGXOHV
�� 8VH�,$0�UROHV�WR�ERRWVWUDS�90V�LQWR�RWKHU�SULYLOHJHV
D� H�J��çGHY�ZHEVHUYHUè�,$0�UROH��JUDQWHG�WR�çGHYHORSHUVè�
XVHU�JURXS��JUDQWV�DFFHVV�WR�VHFUHWV�DSSURSULDWH�WR�WKH�ZHE�VHUYHUV
5HFDS���6HFUHWV
�� 7UHDW�PDQDJHPHQW�RI�6HFUHWV�DV�LWV�RZQ�SUREOHP
D� 'RQèW�GLVWULEXWH�WKHP�E\�KDQG
�� 8VH�(&��5$0�DQG�HSKHPHUDO�VWRUDJH�WR�VWRUH�VHFUHWV
D� :RQèW�EH�FDSWXUHG�LQ�EDFNXSV
7KDQN�\RX�
#NHJLOSLQ�#&RQMXU,QF
ZZZ�OLQNHGLQ�FRP�LQ�MDVRQFDOYHUW
�