O slideshow foi denunciado.
Utilizamos seu perfil e dados de atividades no LinkedIn para personalizar e exibir anúncios mais relevantes. Altere suas preferências de anúncios quando desejar.

Making Security Usable: Product Engineer Perspective

44 visualizações

Publicada em

Anastasiia Voitova goes through several stages of inception and implementation of database encryption and intrusion detection tools. She shows "behind the scenes" work inside a cryptographic engineering company, how customers are one of the most useful people to learn from, and how getting over "we tell you what to do" mentality makes security tools better. Filmed at qconnewyork.com.

Anastasiia Voitova is Product Engineer at Cossacklabs. She has plenty of experience in building mobile apps. She developed many applications, frequently taking care of both iOS and server sides of the system.

Publicada em: Tecnologia
  • Seja o primeiro a comentar

  • Seja a primeira pessoa a gostar disto

Making Security Usable: Product Engineer Perspective

  1. 1. Making Security Usable: Tales of Product Engineering …in a Security Company @vixentael
  2. 2. InfoQ.com: News & Community Site • 750,000 unique visitors/month • Published in 4 languages (English, Chinese, Japanese and Brazilian Portuguese) • Post content from our QCon conferences • News 15-20 / week • Articles 3-4 / week • Presentations (videos) 12-15 / week • Interviews 2-3 / week • Books 1 / month Watch the video with slide synchronization on InfoQ.com! https://www.infoq.com/presentations/ database-encryption-detection-tools
  3. 3. Presented at QCon New York www.qconnewyork.com Purpose of QCon - to empower software development by facilitating the spread of knowledge and innovation Strategy - practitioner-driven conference designed for YOU: influencers of change and innovation in your teams - speakers and topics driving the evolution and innovation - connecting and catalyzing the influencers and innovators Highlights - attended by more than 12,000 delegates since 2007 - held in 9 cities worldwide
  4. 4. #data_security #cryptography #product_thinking #product_design
  5. 5. @vixentael Product Engineer Feel free to reach me with security questions. I do check my inbox :)
  6. 6. I. The story @vixentael
  7. 7. A long time ago in a galaxy far, far away… @vixentael
  8. 8. @vixentael
  9. 9. @vixentael@vixentael
  10. 10. @vixentael
  11. 11. @vixentael
  12. 12. @vixentael
  13. 13. @vixentael
  14. 14. @vixentael
  15. 15. @vixentael Encrypt all the data!
  16. 16. @vixentael
  17. 17. @vixentael ceo@startup.com
  18. 18. @vixentael
  19. 19. @vixentael $encrypted= mcrypt_encrypt( MCRYPT_RIJNDAEL_128, ‘54ca04988748501e93a3061763b0b6a’, $data, MCRYPT_MODE_CBC, $iv );
  20. 20. $encrypted= mcrypt_encrypt( MCRYPT_RIJNDAEL_128, ‘54ca04988748501e93a3061763b0b6a’, $data, MCRYPT_MODE_CBC, $iv ); @vixentael PHP. AES-CBC
  21. 21. $encrypted= mcrypt_encrypt( MCRYPT_RIJNDAEL_128, ‘54ca04988748501e93a3061763b0b6a’, $data, MCRYPT_MODE_CBC, $iv ); @vixentael PHP. AES-CBC
  22. 22. @vixentael Invite pen-testers!
  23. 23. @vixentael
  24. 24. @vixentael Use pre-built tools!
  25. 25. @vixentael postgresql encryption options cybertec-postgresql.com/en/postgresql-instance-level-encryption/ export PGENCRYPTIONKEY=db-enc-key initdb -k -K pgcrypto /data/dbencrypt/
  26. 26. @vixentael 🙄"
  27. 27. @vixentael Hire someone?
  28. 28. No data security expertise? – Find one. @vixentael
  29. 29. II. The challenge @vixentael
  30. 30. @vixentael ? ..but how it should work ..and will it really be secure now? we want one tool that solves all problems..
  31. 31. @vixentael key lifecycle trusted code execution environment side channel resistance risk echelonization
  32. 32. @vixentael ?
  33. 33. @vixentael ?
  34. 34. @vixentael
  35. 35. database encryption proxy @vixentael
  36. 36. @vixentael client app writer proxy database database encryption proxy
  37. 37. @vixentael client app writer proxy server database keygen zones IDS
  38. 38. @vixentael
  39. 39. @vixentael Hard to build
  40. 40. @vixentael Pain to manage
  41. 41. @vixentael
  42. 42. @vixentael accep- tance denial anger barga- ining depre- ssion
  43. 43. Listen to customers. It improves everything... even security! @vixentael
  44. 44. III. The adventure @vixentael
  45. 45. @vixentael security model key/trust scheme encryption scheme cipher suits
  46. 46. @vixentael security model key/trust scheme encryption scheme cipher suits
  47. 47. @vixentael – real time analytics (user actions) – servers load – error logs – user testing / user research – open tickets / issues
  48. 48. @vixentael – real time analytics (user actions) – user testing / user research – servers load – open tickets / issues – error logs
  49. 49. @vixentael ?
  50. 50. @vixentael ?
  51. 51. Bad Usability → Bad Security @vixentael
  52. 52. @vixentael
  53. 53. Data Security Assistance Program @vixentael business model / regulations risks to data threat model / attack vectors data security scheme
  54. 54. @vixentael Analyze use-cases
  55. 55. Analyze use-cases @vixentael Hard to deploy Hard to support Easy to misuse Hard to verify
  56. 56. @vixentael
  57. 57. @vixentael Deployment
  58. 58. @vixentael Deployment code Multiple channels of distribution
  59. 59. @vixentael Deployment code Multiple channels of distribution
  60. 60. @vixentael Deployment code built packages (.pkg) Multiple channels of distribution
  61. 61. @vixentael Deployment Multiple channels of distribution code built packages (.pkg) docker images VM imageschef configuration docker compose
  62. 62. @vixentael Deployment
  63. 63. @vixentael Deployment 1. Download, build, install every component 2. Generate keys / tokens for each component 3. Put keys into right folders (PK exchange) 5. Run components using correct config 4. Configure each component (port, keys)
  64. 64. 2. Generate keys / tokens for each component @vixentael Deployment 1. Download, build, install every component 3. Put keys into right folders (PK exchange) 5. Run components using correct config 4. Configure each component (port, keys) script
  65. 65. @vixentael Deployment 1. Download, build, install every component 3. Put keys into right folders (PK exchange) 5. Run components using correct config 4. Configure each component (port, keys) 2. Generate keys / tokens for each component script
  66. 66. @vixentael Deployment 1. Download, build, install every component 3. Put keys into right folders (PK exchange) 5. Run components using correct config 4. Configure each component (port, keys)defaults 2. Generate keys / tokens for each component script
  67. 67. @vixentael Deployment 1. Download, build, install every component 3. Put keys into right folders (PK exchange) 5. Run components using correct config 4. Configure each component (port, keys) one command! 2. Generate keys / tokens for each component
  68. 68. @vixentael Deployment Pre-baked configurations docker-compose -f <compose_file>.yml up
  69. 69. @vixentael Deployment Pre-baked configurations mysql-ssl-server-ssl.yml MySQL <-SSL-> AServer <-SSL-> client
  70. 70. @vixentael Deployment Pre-baked configurations mysql-ssl-server-ssl.yml MySQL <-SSL-> AServer <-SSL-> client pgsql-nossl-server-ssession-connector.yml PostgreSQL <-> AServer <-SecureSession-> AConnector <---> client ‘-> AWebconfig
  71. 71. @vixentael Deployment Pre-baked configurations
  72. 72. @vixentael Deployment Integration tests everywhere 🙄 – run on 12 OSs – run on empty environments – provide testing scripts for users
  73. 73. @vixentael Integration – logging formats (plaintext, json, CEF) – infrastructure as a code (configs everywhere) – event formats (unique event codes) Good products do not exist in a vacuum
  74. 74. @vixentael
  75. 75. @vixentael Secure by default
  76. 76. @vixentael default strict parameters pre-defined configuration files make accidental changes unlikely Secure by default
  77. 77. API design
  78. 78. API design from pythemis.scell import SCellSeal scell = SCellSeal(key) encrypted_message = scell.encrypt(message, context) message = scell.decrypt(encrypted_message, context) github.com/cossacklabs @vixentael
  79. 79. easy to use @vixentael API design unambiguous to use 2017.hack.lu/archive/2017/hacklu-crypto-api.pdf &&
  80. 80. @vixentael Naming
  81. 81. @vixentael Naming writer proxy server database
  82. 82. db proxyclient app @vixentael Naming writer proxy server database
  83. 83. db proxyclient app @vixentael Naming writer connector server database
  84. 84. @vixentael Naming https://circleci.com/blog/why-did-builds-become-jobs-in-the-ui/
  85. 85. @vixentael Client side client app writer Nodejs Go Python Ruby PHP
  86. 86. @vixentael
  87. 87. @vixentael Docs no docs tons of docs👌
  88. 88. @vixentael Docs for developers integration scenarios security recommendations simple explanations benchmarks security model threat vectors schemes & formulas for security ppl
  89. 89. @vixentael Playgrounds who reads docs if you can play with simulator?
  90. 90. @vixentael Interactive simulator check your encryption works
  91. 91. Examples-examples- examples @vixentael
  92. 92. Dogfooding @vixentael use update feedbackshare
  93. 93. There is no absolute security @vixentael develop test deploy repeat
  94. 94. Short feedback cycle is a key @vixentael
  95. 95. IV. Where it got us? @vixentael
  96. 96. @vixentael Secure defaults Unambiguous APIs Easy deployment Shipped scripts / libs Playgrounds
  97. 97. @vixentael Secure defaults Unambiguous APIs Easy deployment Shipped scripts / libs Playgrounds
  98. 98. @vixentael adopt faster become less frustrated make less mistakes
  99. 99. @vixentael make user-facing decisions iterate faster plan better become less frustrated
  100. 100. usable ≠ over-simplified @vixentael
  101. 101. @vixentael
  102. 102. Home reading? https://medium.com/@kshortridge/security-as-a-product-83a78c45ca27 Security as a Product https://github.com/forter/security-101-for-saas-startups/blob/english/security.md Organization security for startups https://2017.hack.lu/archive/2017/hacklu-crypto-api.pdf API design for cryptography https://cr.yp.to/talks/2015.10.05/slides-djb-20151005-a4.pdf Boring crypto, Daniel J. Bernstein
  103. 103. My other security slides github.com/vixentael/ my-talks
  104. 104. @vixentael Product Engineer Feel free to reach me with security questions. I do check my inbox :)
  105. 105. Image credits www.flaticon.com  freepik, linector, switficons, pixelperfect, smashicons, icon pond, dinosoftlabs Authors:
  106. 106. Watch the video with slide synchronization on InfoQ.com! https://www.infoq.com/presentations/ database-encryption-detection-tools

×