Conference: Jun 26-28, 2017
Workshops: Jun 29-30, 2017
Presentation: BLESS: Better Security and Ops for SSH Access
What You’ll Learn
- Learn an effective way to manage SSH keys for access to servers and to protect the related infrastructure.
- Improve understanding and thinking about the key management problem and suggest some approaches that have been used at Netflix.
- Discuss risks associated and their impact with real world attacks around key management.
Abstract
How can using SSH certificates improve security and simplify operations for instance access at Netflix-scale? How can you smoothly transition existing infrastructure to use SSH Certificates? Netflix created and uses BLESS, an SSH Certificate Authority that runs as an AWS Lambda function and is used to sign SSH public keys. In this talk, you will start by learning about BLESS in general: what it is, how it works, and how you can start using it. Next, we will explore the Netflix BLESS production architecture and how other companies have used BLESS in different ways.
From there, we will dig deeper together to discuss Netflix’s deployment and operational details, leveraging BLESS for security insight, and future plans for authorization improvements. The entire talk will be interactive with demos along the way.
Interview
Bryan: I lead some of our product security teams. We basically do two big buckets of things.
- One is we build security services to make it easy for other engineerings at Netflix to get security right. These are things like key management, secret protection, and TLS enablement.
- Second thing we do is work really closely with other engineers to make sure that the code that they're producing has the right quality bar from a security standpoint. These are things like making sure that Internet facing services aren't vulnerable to attack.
Bryan: BLESS is an open source project we put together at Netflix a couple of years ago. It's a way to handle SSH access to your instances in the cloud. A lot of people will set up a bastion that you log in to before accessing your production instances, but, these approaches (while great), raise some interesting questions around key management. From a risk perspective, this is particularly important when you have a lot of instances in the cloud and a lot of developers accessing those instances.
What BLESS allows us to do is actually shift that around so that we use an AWS Lambda function to work as an SSH certificate authority. This Lambda function has access to a private key that can sign a certificate that gives you access to SSH into a cloud instance for five minutes. So it works like this, you prove you're the right person and have access to the resource. Then BLESS provides your well scoped credential. If that credential is ever lost you know you have a very limited scope that works for a limited time period.
Bryan: Here we are a year later after releasing BLESS as an open source project. We're going to talk about the ecosystem that we've created around it, and how it fits into Netflix. We will be talking about some of the operational lessons learned. The hope is to make it easy for an engineer to think through these ideas and see how they could fit into their world, and they could deploy BLESS or a similar type solution if they wanted to.
Similar Talks
Tracks
Monday, 26 June
-
Microservices: Patterns & Practices
Practical experiences and lessons with Microservices.
-
Java - Propelling the Ecosystem Forward
Lessons from Java 8, prepping for Java 9, and looking ahead at Java 10. Innovators in Java.
-
High Velocity Dev Teams
Working Smarter as a team. Improving value delivery of engineers. Lean and Agile principles.
-
Modern Browser-Based Apps
Reactive, cross platform, progressive - webapp tech today.
-
Innovations in Fintech
Technology, tools and techniques supporting modern financial services.
Tuesday, 27 June
-
Architectures You've Always Wondered About
Case studies from the most relevant names in software.
-
Developer Experience: Level up Your Engineering Effectiveness
Trends, tools and projects that we're using to maximally empower your developers.
-
Chaos & Resilience
Failures, edge cases and how we're embracing them.
-
Stream Processing at Large
Rapidly moving data at scale.
-
Building Security Infrastructure
How our industry is being attacked and what you can do about it.
Wednesday, 28 June
-
Next Gen APIs: Designs, Protocols, and Evolution
Practical deep-dives into public and internal API design, tooling and techniques for evolving them, and binary and graph-based protocols.
-
Immutable Infrastructures: Orchestration, Serverless, and More
What's next in infrastructure. How cloud function like lambda are making their way into production.
-
Machine Learning 2.0
Machine Learning 2.0, Deep Learning & Deep Learning Datasets.
-
Modern CS in the Real World
Applied, practical, & real-world dive into industry adoption of modern CS.
-
Optimizing Yourself
Maximizing your impact as an engineer, as a leader, and as a person.
-
Ask Me Anything (AMA)
