Security Patterns for Microservice Architectures

on YouTube ↗41m

" summary

Lists 11 patterns for securing microservices and gives concrete fixes: use OAuth2/OpenID Connect with client‑credentials for server‑to‑server, prefer Certbot/Let’s Encrypt for TLS (Let’s Encrypt has issued ~1 billion certs), scan deps with Dependabot and Snyk/JFrog X‑Ray, avoid JWT as session tokens (Paseto suggested), store secrets in HashiCorp Vault or AWS KMS, run ZAP in CI, enable Docker rootless, Kubernetes RBAC + Istio service mesh, rate limiting and adaptive MFA.

AI-written summary · about

" chapters (36)

1. 0:00Intro
2. 1:41Why Microservices?
3. 2:51Matt to the Rescue!
4. 3:19Be Secure by Design
5. 3:52Remove Malicious Characters
6. 4:57What About OWASP?
7. 6:01Secure by Design Example
8. 8:35Scan Dependencies
9. 9:35The Application Patching Manifesto
10. 10:12GitHub and Dependabot
11. 11:49Use HTTPS Everywhere
12. 13:14HTTPS for Static Sites too!
13. 14:15TLS Certificates
14. 14:32Get Free Certificates from Let's Encrypt
15. 15:13Use Certbot
16. 17:28Secure RSocket Endpoints
17. 18:55Use Access and Identity Tokens
18. 20:09Secure Server-to-Server Communication
19. 20:36Authorization Servers: Many to One
20. 24:10Encrypt and Protect Secrets
21. 25:09HashiCorp Vault and Azure Key Vault
22. 25:23Secure Secrets With Spring Cloud Config and Vault
23. 25:39Amazon Key Management Service (KMS)
24. 26:19Verify Security with Delivery Pipelines
25. 27:23Hacking Docker Recommendations
26. 27:56What About the Code?
27. 28:53Slow Down Attackers
28. 29:46Use Docker Rootless Mode
29. 30:26Use Time-Based Security
30. 31:20Sidenote: Randall's Thoughts on MFA
31. 32:16Scan Docker and K8s Configurations
32. 33:27Top 5 Docker Vulnerabilities
33. 33:52Know Your Cloud and Cluster Security
34. 34:2511 Ways (Not) to Get Hacked
35. 35:10Run a Service Mesh
36. 36:26Excellent Security Patterns for Microservice Architectures

" related talks

• 38mTop 10 Security Best Practices to secure your MicroservicesChintan Jain · AppSec USA 2017
• 51mAppSec and MicroservicesSam Newman · JavaDay Ukraine 2017
• 01h 02mPractical Microservice SecurityLaura Bell · NDC Sydney 2016
• 01h 02mLock That Sh*t Down! Auth Security Patterns for Apps, APIs, and InfraMatt Raible, Brian Demers · Joker 2021
• 49mPractical Microservice SecurityLaura Bell · GOTO Chicago 2016
• 57mHow Do I Secure My Micro-Services?John Melton · CodeMash 2018
• 53mSecurity And MicroservicesSam Newman · NDC Sydney 2017
• 51mInsecure Transit - MicroserviceSam Newman · GOTO Berlin 2018