Patterns for Service Security in Hybrid Public/Private Cloud Deployments

(1)

Patterns for Service Security in

Hybrid Public/Private Cloud Deployments

Gulrukh Ahanger

VP of Product Development

(2)

The cloud is here!

(and it always has been)

Wheel of

reincarnation

MULTICS

Mainframes

Client/Server

(3)

Cloud Computing:

The Mainframe

Reincarnated

http://de.sys-con.com/node/723583

The Cloud isn’t a

mainframe.

Seriously.

http://siliconangle.com/blog/2009/10/23/the-cloud-isnt-a-mainframe-seriously/

The cloud is here!

(4)

Many similarities, but also a few key differences:

• “n-datacenter”, not multi-datacenter

• Sharded for resiliency, not geographic availability

• “Scarcity” vs “Abundance” as a design philosophy

(5)

“measure twice, cut once.”

(6)

“it is better to fix problems

than to prevent them”

- ed catmull

(7)

software

engineering

quality

assurance

technology

operations

DevOps

AKA

the science

of software

SDLC



Agile



DevOps

Process



Incremental



Autonomous*

Large systems have emergent properties

Deployment

model

(8)

Implications of DevOps

Comcast Confidential & Proprietary

8

• tools not tickets, dev=ops

• federation of data and infrastructure , not

“source of truth”

• fail fast: ops improvisation is not good

(9)

Traffic Shaping is a Core Primitive

Comcast Confidential & Proprietary

9

• failure is an operating mode

• fail back/fail forward

• multi-instance

• incremental validation

• backwards compatibility

• forwards compatibility

(10)

• trunk based development: branch for release

• continuous Integration

• sprints are when you ship

• shipping happens all the time

(11)

Reuse Equivalency Principle

Comcast Confidential & Proprietary

11

• the unit of re-use is the unit of release

• effective re-use requires tracking release

• the unit of release should be the unit of fail

(12)

X1 platform:

logical view

Comcast Confidential & Proprietary

12 HTML Guide

XRE Receiver

HTML Browser

Client platforms

or

Encoders

Packagers

Content Routers

CMS

Edge Caches

Content Mgmt

Content

Transform

Distribution

Multicast controllers

Virtual Origin

Security

_{Key Manager}

_{License Server}

Content

Services

User

Services

Application Services

XRE Guide

Data Services

Presentation

Services

Vide

o

App

lic

ation

Separating discovery from

_{delivery means:}

-IP apps can leverage QAM video

-IP video can be delivered to many

applications

(13)

X1 platform:

physical view ::: NO PODS :::

Comcast Confidential & Proprietary

13 Client platforms

Encoders Packagers Content Routers CMS Edge Caches Content Mgmt Content Transform Distribution Multicast controllers Virtual Origin

Security Key Manager License Server

Content Services User Services Application Services XRE Guide Data Services Presentation Services Encoders Packagers Content Routers CMS Edge Caches Content Mgmt Content Transform Distribution Multicast controllers Virtual Origin

Content Services User Services Application Services XRE Guide Data Services Presentation Services Encoders Packagers Content Routers Edge Caches Content Transform Distribution Multicast controllers Virtual Origin Encoders Packagers Content Routers Edge Caches Content Transform Distribution Multicast controllers Virtual Origin Encoders Packagers Content Routers Edge Caches Content Transform Distribution Multicast controllers Virtual Origin Encoders Packagers Content Routers Edge Caches Content Transform Distribution Multicast controllers Virtual Origin

NDC

Vide

o

App

lic

ation

Vide

o

App

lic

ation

Vide

o

Vide

o

Vide

o

Vide

o

• Elasticity

• Ubiquity

RDC

(14)

X1 platform:

replicated to AWS/etc. (public)

Comcast Confidential & Proprietary

14 Client platforms

Encoders Packagers Content Routers CMS Edge Caches Content Mgmt Content Transform Distribution Multicast controllers Virtual Origin

Content Services User Services Application Services XRE Guide Data Services Presentation Services Encoders Packagers Content Routers CMS Edge Caches Content Mgmt Content Transform Distribution Multicast controllers Virtual Origin

Content Services User Services Application Services XRE Guide Data Services Presentation Services Encoders Packagers Content Routers Edge Caches Content Transform Distribution Multicast controllers Virtual Origin Encoders Packagers Content Routers Edge Caches Content Transform Distribution Multicast controllers Virtual Origin Encoders Packagers Content Routers Edge Caches Content Transform Distribution Multicast controllers Virtual Origin Encoders Packagers Content Routers Edge Caches Content Transform Distribution Multicast controllers Virtual Origin

NDC

Vide

o

App

lic

ation

Vide

o

App

lic

ation

Vide

o

Vide

o

Vide

o

Vide

o

Elasticity!!

Security?

RDC

(15)

Important similarity to mainframe is of “remote trust”

Traditional enterprise security: Hard shell, soft inside

Perimeter complacency!

(16)

Availability

Redundancy

Responsiveness

Privacy

Access controls

Theft of data

Security Considerations

(17)

Anti-Pattern

Oracle w/Golden Gate

MongoDB

Pattern

CouchDB

Cassandra

PostgreSQL

Redundancy

Key attributes:

(18)

Anti-Pattern

Pattern

Responsiveness

Key attributes:

Limit surface area of attack, connection pooling, abstraction of performance

Microservices (s/c)

Geo-stickiness

(because zombies)

Macroservice (s/c)

Persistence (s/s)

HA

Realtime metrics

(19)

Anti-Pattern

Pattern

Access Controls

Key attributes:

Access based on User Context, risk-based approach: extra monitoring, locate meaningful