Conjur - AWS Boston Meetup 2014 - Defense in Depth
-
Upload
kevin-gilpin -
Category
Technology
-
view
413 -
download
0
description
Transcript of Conjur - AWS Boston Meetup 2014 - Defense in Depth
.HYLQ�*LOSLQ��-DVRQ�&DOYHUW)HEUXDU\���������
'HIHQG�\RXU�,QIUDVWUXFWXUHZLWK�5RERW�,GHQWLW\�DQG�$XWKRUL]DWLRQ
3UREOHPV�)UHTXHQWO\�6HHQ�LQ�WKH�&ORXG
2SHUDWLRQDOï /RVW�FUHGHQWLDOV���%,*�352%/(0���DFFHVV�WR�VRXUFH�FRGH��DGPLQ�ER[��RWKHU�FUHGHQWLDOV�GDWD
ï 2YHUO\�SHUPLVVLYH�FRQWUROV���HVSHFLDOO\�IRU�LQWHUQDO�,7�XVHUV
ï 3RRU�DXGLWLQJ���YHU\�IHZ�FRPSDQLHV�FDQ�UHFUHDWH�ZKDW�KDSSHQHG�IRU�D�EUHDFK���NHHS�ORJV�IRU�D�ORQJ�WLPH�RQ�VHSDUDWH�V\VWHPV
&UHGHQWLDOV�DUH�%,**(67�SUREOHP�ZLWK�$:6
$OH[�6WDPRV��$:6�UH�,QYHQW�����KWWS���ZZZ�HYHU\WDON�WY�WDONV������$PD]RQ�:HE�6HUYLFHV�UH�,QYHQW�6(&�����%XLOGLQJ�6HFXULW\�IURP�6FUDWFK�LQ�$:6
3UREOHPV�)UHTXHQWO\�6HHQ�LQ�WKH�&ORXG
,QIUDVWUXFWXUHï ,QVHFXUH�FRQWURO�SODQH���86(�66/�(9(5<:+(5(
ï $WWDFNV�IURP�LQVLGH�WKH�&RUSRUDWH�1HWZRUN
$SSOLFDWLRQï 7RR�ORRVH�ELQGLQJV���KDFN�WKH�ZHE�VHUYLFHV�GLUHFWRU\�ĺ�5(67�LQWHUIDFH�ĺ��GR�ZKDWHYHU
ï :HE�$3,�9XOQHUDELOLWLHV
ï 3RRU�XVH�RI�FU\SWRJUDSK\
$OH[�6WDPRV��$:6�UH�,QYHQW�����KWWS���ZZZ�HYHU\WDON�WY�WDONV������$PD]RQ�:HE�6HUYLFHV�UH�,QYHQW�6(&�����%XLOGLQJ�6HFXULW\�IURP�6FUDWFK�LQ�$:6
:H�+DYH�)DLOHG�<RX��/RUG�9DGHU
䕵 ([WHUQDO�YHQGRUV�H[SRVHG�DV�WKH�ZHDN�OLQN�LQ�HQWHUSULVH�VHFXULW\
䕵 7ULYLDO�SULYLOHJH�OHYHOV�H[SORLWHG�DQG�HVFDODWHG�WR�JDLQ�DFFHVV�WR�WKH�PRVW�FULWLFDO�GDWD
5LJKW�6FULSW��:URQJ�(QYLURQPHQW䕵 $:6�0DLQWHQDQFH�VFULSW�GHOHWHV�
(ODVWLF�/RDG�%DODQFHU�'%�UHFRUGV�XVHG�IRU�VHOI�PDQDJHPHQW
䕵 .DERRP��1HWIOL[�HW�DO
1DWLRQ�LV�XQDEOH�WR��ZDWFK�ê$�&KULVWPDV�&DUROë�DQG�OLYH�WKH�WUXH�PHDQLQJ�RI�&KULVWPDV
6ROXWLRQ��.HHS�7UDFN�RI�7KLQJV%H�RUJDQL]HG��DQG�
PDLQWDLQ�FRQWURO�RI�
䕵 3DVVZRUGV䕵 3ROLFLHV䕵 $FFHVV�UXOHV䕵 *URXSV�DQG�UROHV䕵 6HFXUH�FRPPXQLFDWLRQ
&ORVLQJ�WKH�ê&RPSOLDQFH�*DSë$:6�SURYLGHV� $:6�GRHV�QRW�SURYLGH�
Ɣ 3K\VLFDO�VHFXULW\
Ɣ 6RIWZDUH�GHILQHG�QHWZRUN
Ɣ 5HOLDEOH�$0,V
Ɣ :D\V�WR�VWURQJO\�SDUWLWLRQ�LQIR��HJ��DFFRXQWV�
Ɣ 'XUDELOLW\
Ɣ ,DD6�EDFNSODQH
Ɣ 0DQDJH�$:6�FUHGHQWLDOV
Ɣ 3DVVZRUGV
Ɣ $:6�SROLFLHV
Ɣ (QFU\SWLRQ�NH\V�DQG�RWKHU�VHFUHWV
Ɣ $SSOLFDWLRQ�WLHU�DXGLW
6QRZIODNHV䕵 /RWV�RI�2SWLRQV�LQ�$:6
䕵 0DQXDO�DGPLQLVWUDWLRQ�RI�WRR�PDQ\�RSWLRQV�SURGXFHV�êVQRZIODNHVë
䕵 ê6QRZIODNHV�VRRQ�EHFRPH�KDUG�WR�XQGHUVWDQG�DQG�PRGLI\ë
䕵 $SSOLHV�WR�VHUYHUV��SROLFLHV��DXWK]��DUFKLWHFWXUH��HWF�
7KHUHIRUH��DXWRPDWH��WHVW��DQG�YHULI\
KWWS���IOLF�NU�S��FYUI
'RQèW�6KRUWFXW�<RXU�:D\�LQWR�7URXEOH
0DQXDO�KDFNLQJ�LV�QRW�D�VKRUWFXW
%H�5HSURGXFLEOH
䕵 6DPH�SDFNDJHV䕵 6DPH�FRQILJXUDWLRQ
ð�DQGð
䕵 6DPH�SULYLOHJHV
&RPPRQ�3UREOHP���$XWKRUL]DWLRQ
䕵 'HIHQG�LQ�GHSWK
䕵 6LQJOH�SHULPHWHU�GHIHQVH�LV�QRW�VXIILFLHQW
䕵 $SSO\�WKH�PRVW�H[WHQVLYH�SURWHFWLRQ�WR�WKH�PRVW�YDOXDEOH�DVVHWV
KWWS���ZZZ�FVRRQOLQH�FRP�DUWLFOH��������LQIRUPDWLRQ�VHFXULW\�GHIHQVH�LQ�GHSWK�OHVVRQV�IURP�D�EURQ]H�DJH�IRUW�"SDJH �
<RXU�$XWK]�)RUWUHVV
&OLHQW�7HUPLQDO
6HFXUH0HVVDJH4XHXH
90��6HUYLFH Ɣ $OO�FORXG�FUHGHQWLDOV�DQG�,$0�SROLFLHV�DXWR�JHQHUDWHG�DQG�PDQDJHG�SURJUDPPDWLFDOO\
Ɣ $OO�LQWHUDFWLRQV�GHILQHG�DQG�UHSRUWDEOH�E\�DXWK]�SROLFLHV
Ɣ $OO�LQWHUDFWLRQV�FKHFNHG�E\�DXWK]Ɣ $OO�VHFUHWV�GLVWULEXWHG�SURJUDPPDWLFDOO\
ż &ORXG�NH\V��NH\�SDLUV��SDVVZRUGV��HWF�IHWFKHG�YLD�KXPDQ�RU�URERW�LGHQWLW\
ż �����DXWRPDWHG�NH\�SDVVZRUG�URWDWLRQ
Ɣ 6LJQHG�TXHXH�PHVVDJHVƔ (QFU\SWLRQ�LQ�WUDQVLWƔ (YHU\�LQWHUDFWLRQ�UHFRUGHG�WR�,DD6�DQG�
DSSOLFDWLRQ�DXGLW
�
�
�
�
$PD]RQ�,$0���$XWRPDWH�,W䕵 9HU\�GHWDLOHG��JUDQXODU䕵 (DV\�WR�SURSDJDWH�SULYLOHJHV�WR�
90V�YLD�,$0�5ROHV�IRU�(&�䕵 *LYHV�D�ZD\�WR�SURSDJDWH�
SULYLOHJHV�IURP�XVHUV�WR�90V䕵 &DQ�ERRWVWUDS�WR�RWKHU�SULYLOHJHV䕵 ,$0�DFWLRQV�DUH�FDSWXUHG�LQ�
&ORXG7UDLO��$:6�DXGLW�
䕵 +DUG�WR�XVH�ILQH�JUDLQHG�SHUPLVVLRQV�IRU�GHYHORSPHQW
䕵 7ULDO�DQG�HUURU䕵 1R�KLJK�OHYHO�UHSRUWLQJ�RQ�
SHUPLVVLRQV
ê:LULQJë��&RQQHFWLQJ�6\VWHPV�7RJHWKHU
(DFK�NH\�HVWDEOLVKHV�D�FRQQHFWLRQ�EHWZHHQ�WZR�DSSOLFDWLRQ�FRPSRQHQWV
$�FRPSRQHQW�ZLWKRXW�NH\V�LV�êRUSKDQHGë�DQG�KDUPOHVV���QRQ�IXQFWLRQDO
6HFUHWV��WKH�6QRZIODNH�3UREOHP
䕵 0DQXDO�FRS\LQJ�ĺ�VQRZIODNHV��ORVV
䕵 0DQXDO�SROLFLHV�ĺ�SULYLOHJH�FUHHS
0DQXDO�ĺ�HQWURS\�ĺ��IDLOXUH
&RQILJXUDWLRQ�0DQDJHPHQW�LV�QRW�.H\�0DQDJHPHQW
&RQILJXUDWLRQ�PDQDJHPHQW�PD\�)((/�OLNH�D�JRRG�ZD\�WR�GLVWULEXWH�VHFUHWV�
ð
%XW�WKLV�LV�MXVW�D�FDVH�RI�ZLHOGLQJ�D�KDPPHU�DQG�WUHDWLQJ�HYHU\WKLQJ�DV�D�QDLO
ð
&RQILJXUDWLRQ�PDQDJHPHQW�GRQèW�KDQGOH�VHFUHWV��DXWK]��RU�DXGLW�YHU\�ZHOO
&RQILJXUDWLRQ�0DQDJHPHQW�LV�&RQIXVLQJ�3HRSOH�$ERXW�6HFUHWV
&RQILJXUDWLRQ�0DQDJHPHQW�LV�QRW�.H\�0DQDJHPHQW
7ZR�RUWKRJRQDO�FRQFHUQV��� ,QVWDOO�SDFNDJHV�DQG�HVWDEOLVK�
FRQILJXUDWLRQ�VHWWLQJV
�� ê:LUH�XSë�WKH�V\VWHP�ZLWK�LGHQWLW\�DQG�VHFUHWV
6\VWHP�êZLULQJë�VKRXOG�QRW�EH�LQ�WKH�GRPDLQ�RI�FRQILJXUDWLRQ�PDQDJHPHQW
([DPSOH��&KHI
(QFU\SWHG�GDWD�EDJV�ê7KH�FKHI�FOLHQW�XVHV�VKDUHG�VHFUHW�HQFU\SWLRQë
䕵 +RZ�LV�WKH�VKDUHG�VHFUHW�GLVWULEXWHG"
䕵 <RX�VWLOO�QHHG�D�VHFUHWV�$3,��KRVW�LGHQWLW\�DQG�SHUPLVVLRQV�V\VWHP
6R�$JDLQ
&RQILJXUDWLRQ�� �6HFUHWV
6HFUHWV�LV�LWV�2ZQ�3UREOHP
,W�LV�QRW�D�VXE�FDWHJRU\�RI�&RQILJXUDWLRQ�0DQDJHPHQW�%(&$86(�LW�LV�DOO�DERXW�LGHQWLW\�DQG�DXWKRUL]DWLRQ��VHSDUDWLRQ�RI�UROHV�DQG�FRQFHUQV�
ê/HDVW�SULYLOHJHë��êVHSDUDWLRQ�RI�GXWLHVë��êDXGLWë�ĺ�DUH�WKH�NH\�UHTXLUHPHQWV
$XWRPDWH�$OO�6HFUHWV�� $VVLJQ�LGHQWLW\�WR�KRVW
�� *UDQW�SULYLOHJHV�WR�KRVW
�� )HWFK�VHFUHWV�YLD�FRPPDQG�OLQH�RU�FRQILJXUDWLRQ�PDQDJHPHQW�KHOSHU
�� %HWWHU�\HW��IHWFK�DQG�XVH�VHFUHWV�RQ�GHPDQG�DQG�NHHS�WKHP�RII�PDFKLQHV
��(VWDEOLVK�LGHQWLW\�RI�WKH�KRVW��VHFUHWV�ORJLQ��X�KRVWLG��2EWDLQ�VHFUHW��VHFUHWV�IHWFK�VWDJH�P\VTO�SDVVZRUG�!��HWF�P\VTOBSDVVZRUG
SZG� �VHFUHWV�IHWFK�´VWDJH�P\VTO�SDVVZRUGµ�WHPSODWH�´�HWF�P\VTO�FRQIµ�GR��VRXUFH�´P\VTO�FRQI�HUEµ��YDULDEOHV�SDVVZRUG��SZGHQG
,GHQWLW\�LV�WKH�)RXQGDWLRQ�RI�3HUPLVVLRQV
䕵 ,GHQWLW\�LV�WKH�PHDQV�WR�DQ�HQG䎗 &RQWURO�DQG�FHUWDLQW\
䕵 7KH�HQG�LV�JUDQWLQJ�UROHV�ZKLFK�KDYH�SULYLOHJHV
䕵 5ROH�JUDQWV�PXVW�IORZ�IURP�D�KLJKHU�DXWKRULW\
+RVW�,GHQWLW\
䕵 $:6�SURYLGHV�WUXVWHG�VRXUFH�,3
6WUHQJWKHQ�ZLWK�
䕵 &UHGHQWLDOV�ĺ�+RVW�,G�SOXV�6HFUHW
䕵 66/�PXWXDO�DXWKHQWLFDWLRQD� 'HULYH�FHUWLILFDWHV�IURP�PDVWHU�WUXVWHG�FHUW
,GHQWLW\�YLD�$XWKRULW\
䕵 ,GHQWLW\�IORZV�IURP�D�FHQWUDO�DXWKRULW\
䕵 7UXVW�LQ�WKH�DXWKRULW\�PXVW�EH�EXLOW�LQ
$Q�$XWKRULW\�IRU�$:6
䕵 $�ZHE�VHUYLFH䎗 /LNH�HYHU\WKLQJ�HOVH
䕵 ,Q�D�GHGLFDWHG�$:6�DFFRXQW䎗 6R�WKDW�WKHUH�LV�QR�ZD\�WR�DFFLGHQWDOO\�êOHDNë�SULYLOHJH�WR�DFFHVV�WKH�
DXWKRULW\�ER[
䕵 ,VVXHV�H[SLULQJ�DXWK�WRNHQV
䕵 +ROGV�D�FHUWLILFDWH�ZKLFK�LV�WUXVWHG�E\�WKH�UHVW�RI�WKH�V\VWHP
(VWDEOLVK�7UXVW�:LWK�D�&HUWLILFDWH
䕵 &UHDWH�D�êVLPSOHë�&$
䕵 %XLOG�$0,�ZLWK�HPEHGGHG�7��FHUW
䕵 $OO�\RXU�90V�ZLOO�WUXVW�WKLV�FHUW
3OXV�SURSDJDWLQJ�LGHQWLW\�RI�RULJLQDO�UHTXHVWHU
3OXV�DQ�LGHQWLW\�EDVHG�DXWK]�JDWHNHHSHU
3OXV�D�VKDUHG�VHFUHW
6HUYLFH�WR�6HUYLFH�$XWK]
$�0DWXULW\�0RGHO�IRU�$SSV�DQG�&RQWURO�3ODQH
7UXVW�HYHU\WKLQJ��UHVWULFW�WUDIILF�YLD�VHFXULW\�JURXSV 6HFXULW\�JURXS�VHWWLQJV�
FDQ�EH�PRGLILHG
$:6�,$0�%DG�%HKDYLRU�([DPSOH
䕵 /DXQFK�D�90�IURP�$:6�0DUNHWSODFH
䕵 90�UHTXHVWV�DQ�êDGPLQLVWUDWRUë�OHYHO�FUHGHQWLDO
䕵 3XVK�EDFN�WR�YHQGRU�\LHOGV�WKH�DFWXDO�SROLF\�WKDW�WKH�90�QHHGV
KWWS���IRUXP�[GD�GHYHORSHUV�FRP�VKRZWKUHDG�SKS"W ������SDJH �
$:6�,$0�%HWWHU�%HKDYLRU
%HWWHU�6ROXWLRQ䕵 90�VHWXS�VFULSW�UHTXHVWV�DQ�
DGPLQ�FUHGHQWLDO
䕵 90�FUHDWHV�DQG�VDYHV�LWV�RZQ�LGHQWLW\�DQG�PLQLPDO�SROLF\
䕵 90�êIRUJHWVë�WKH�DGPLQ�FUHGHQWLDO
$:6�,$0�%HVW�%HKDYLRU
%HVW�6ROXWLRQ䕵 9HQGRU�SURYLGHV�SROLF\
䕵 $GPLQ�FUHDWHV�,$0�UROH�DQG�DSSOLHV�SROLF\
䕵 $GPLQ�JUDQWV�WKH�,$0�UROH�WR�WKH�90
ĺ�1R�VWRUDJH�RI�FUHGHQWLDOV�RQ�GLVN
6HFXUH�WKH�&RQWURO�3ODQH
䕵 ,QYHVW�LQ�66/�IRU�\RXU�FRQWURO�SODQH�VHUYLFHV
䕵 5REXVW�DXWKQ���DXWK]�IRU�DGPLQ�DFFHVV�WR�ER[HV䎗 35,9$7(�.(<6�,668('�%<�(&��$5(�)25�(0(5*(1&<�$&&(66�
21/<
䎗 ��IDFWRU�DXWK
䎗 $XWKRUL]DWLRQ��H�J��/'$3��ZKLFK�LV�VHSDUDWH�DQG�DGGLWLRQDO�WR�DXWKHQWLFDWLRQ�PDNHV�GH�SURYLVLRQLQJ�PXFK�HDVLHU
,GHQWLW\�3URSDJDWLRQ���6WURQJHU�WKDQ�6HUYLFH�,GHQWLW\
1H[W�6HUYLFH���
8VHU�,GHQWLW\�3URSDJDWHG�WR�6HUYLFH�%
6HUYLFH�$
3ULYLOHJHG�8VHU��,GHQWLW\
5HFDS���*URXQGZRUN
�� 8VH�D�VHSDUDWH�$:6�DFFRXQW�IRU�VHFXULW\�SXUSRVHV
�� %XLOG�DQ�$0,�WR�WUXVW�WKLV�DXWKRULW\D� :LUH�XS�ORJJLQJ��PRQLWRULQJ��HWF�ZKLOH�\RX�DUH�DW�LW
�� ,VVXH�LGHQWLW\�IURP�WKLV�VHUYLFH
5HFDS���,$0
�� $XWRPDWH�WKH�JHQHUDWLRQ�RI�,$0�XVHUV��UROHV��DQG�SROLFLHV
D� &RPELQH�WKLV�ORJLF�LQWR�WHVWDEOH��UHXVDEOH��VHFXUH�PRGXOHV
�� 8VH�,$0�UROHV�WR�ERRWVWUDS�90V�LQWR�RWKHU�SULYLOHJHV
D� H�J��çGHY�ZHEVHUYHUè�,$0�UROH��JUDQWHG�WR�çGHYHORSHUVè�
XVHU�JURXS��JUDQWV�DFFHVV�WR�VHFUHWV�DSSURSULDWH�WR�WKH�ZHE�VHUYHUV
5HFDS���6HFUHWV
�� 7UHDW�PDQDJHPHQW�RI�6HFUHWV�DV�LWV�RZQ�SUREOHP
D� 'RQèW�GLVWULEXWH�WKHP�E\�KDQG
�� 8VH�(&��5$0�DQG�HSKHPHUDO�VWRUDJH�WR�VWRUH�VHFUHWV
D� :RQèW�EH�FDSWXUHG�LQ�EDFNXSV
7KDQN�\RX�
#NHJLOSLQ�#&RQMXU,QF
ZZZ�OLQNHGLQ�FRP�LQ�MDVRQFDOYHUW
�