Secrets at Scale: Automated Bootstrapping of Secrets & Identity in the Cloud

Monday, January 30, 2017 - 10:30am11:00am

Ian Haken, Senior Security Software Engineer, Netflix

Abstract: 

Almost any web service needs secrets to operate. Whether it’s encryption keys for storing credit card data and personally identifiable information, authentication tokens for talking to third party services, or just a password for connecting to the local database, if your application lives online it probably has a secret. But how do you actually keep those secrets secret? In an ideal world access would be tightly restricted; neither developers, nor continuous integration, nor deployment tools would ever see them. But for applications deployed in the cloud which need to automatically instantiate new instances to match demand and replace unhealthy nodes, this creates an even greater challenge; how can an application be automatically deployed with its secrets if even the deployment tools can’t be allowed to see them?

In this talk I will describe how we have approached this problem at Netflix: an environment supporting thousands of independent microservice applications, all of which need the capability to automatically scale and self-heal. Along the way, I’ll describe how this problem becomes inexorably intertwined with the question of secure, provable, and ephemeral identity, and how we ultimately architected a solution to both problems.

Ian Haken, Senior Security Software Engineer, Netflix

Ian Haken is a senior security software engineer at Netflix where he works on the Platform Security team to develop tools and services that defend the Netflix platform. Before working at Netflix, he spent two years as security researcher at Coverity where worked on static analysis tools for the automatic discovery and remediation of security vulnerabilities. He received his PhD in mathematics from the University of California, Berkeley in 2014 with a focus in computability theory and algorithmic information theory. Ian has given talks at several other information security conferences including BlackHat EU, AppSec EU, and BSides Seattle.

Open Access Media

USENIX is committed to Open Access to the research presented at our events. Papers and proceedings are freely available to everyone once the event begins. Any video, audio, and/or slides that are posted after the event are also free and open to everyone. Support USENIX and our commitment to Open Access.

BibTeX
@conference {202174,
author = {Ian Haken},
title = {Secrets at Scale: Automated Bootstrapping of Secrets \& Identity in the Cloud},
year = {2017},
address = {Oakland, CA},
publisher = {{USENIX} Association},
month = jan,
}

Presentation Video