AppSec And Microservices
3 likes•4,423 views
The document discusses the integration of application security (AppSec) within microservices architecture, highlighting the importance of small, autonomous services that collaborate based on business domains. It addresses various security aspects such as prevention, detection, response, and recovery, emphasizing the need for secure communications and proper management of client-side certificates. Additionally, it touches on challenges like perimeter security, maintaining data integrity, and the complexities introduced by utilizing multiple technologies.
AppSec And Microservices
- 1. APPSEC AND MICROSERVICES Sam Newman O’Reilly Software Architecture Conference, NYC 2016
- 2. @samnewman
- 3. @samnewman
- 7. @samnewman
- 8. @samnewman
- 10. @samnewman Accounts Returns Invoicing Shipping Inventory Customer Service Small Autonomous services that work together, modelled around a business domain
- 11. https://www.flickr.com/photos/wwworks/2607036664/
- 12. https://www.flickr.com/photos/lkowen/15803718243/
- 13. @samnewman
- 14. @samnewman
- 15. @samnewman
- 16. @samnewman
- 17. @samnewman
- 28. @samnewman Open Safe Pick Lock Learn Combo Cut Open
- 29. @samnewman Open Safe Pick Lock Learn Combo Cut Open Find Written Combo Get Combo from the target
- 30. @samnewman Open Safe Pick Lock Learn Combo Cut Open Find Written Combo Get Combo from the target Blackmail Threaten Bribe
- 31. @samnewman Open Safe Pick Lock Learn Combo Cut Open Find Written Combo Get Combo from the target Blackmail Threaten Bribe Impossible Impossible Impossible Possible Possible Possible
- 36. BENEFITS OF HTTPS? ▫︎Server guarantees!
- 37. BENEFITS OF HTTPS? ▫︎Server guarantees! ▫︎Payload not manipulated…
- 38. BENEFITS OF HTTPS? ▫︎Server guarantees! ▫︎Payload not manipulated… ▫︎…but no client guarantee and…
- 39. BENEFITS OF HTTPS? ▫︎Server guarantees! ▫︎Payload not manipulated… ▫︎…but no client guarantee and… ▫︎…certificates can be a pain
- 41. @samnewman
- 45. CLIENT-SIDE CERTIFICATES? ▫︎Client guarantees! ▫︎…but a PITA to manage….
- 48. @samnewman Auth?
- 58. @samnewman https://www.qualys.com/research/top10/
- 59. @samnewman
- 63. @samnewman Polyglot = more stuff to track!
- 64. @samnewman Polyglot = more things to break?
- 67. @samnewman
- 68. @samnewman
- 69. @samnewman
- 71. @samnewman Comms
- 72. @samnewman
- 73. @samnewman
- 78. @samnewman Backups Burn it all down
- 79. @samnewman Backups Burn it all down Harder with microservices?
- 81. @samnewman Sam Newman Building Microservices DESIGNING FINE-GRAINED SYSTEMS http://buildingmicroservices.com/
- 82. @samnewman Sam Newman Building Microservices DESIGNING FINE-GRAINED SYSTEMS http://buildingmicroservices.com/ http://samnewman.io/
- 83. @samnewman Sam Newman Building Microservices DESIGNING FINE-GRAINED SYSTEMS http://buildingmicroservices.com/ http://magpietalkshow.com/ http://samnewman.io/