- ID
- 5eca1070-5f77-49cd-9b46-6bde7ba798e1
2022-01-13 - Thursday
15Five
DONE [[id:4ac33fca-9389-4fee-9ab2-d7337628c7da][ENG-17655 - Add Compright as new partner app in production]]
CLOSED:
https://15five-dev.atlassian.net/browse/ENG-17655
DONE Security tech interview with [[id:9123ac00-7101-4dd6-9b94-595b73fc125b][Piotr Siemieniak]] [0/3]
CLOSED:
First exercise is the Secure Code Review:
- [ ] Primary problem? No data validation
- No validation, iterate over key value pairs of any data passed in
- What are requirements for this endpoint?
- One type of cookie to iterate, multiple?
- Use a whitelist to define which of those should be editable
- Need that type of validation in the first place
- Secondly, what are you updating the session key and value with?
- Risk we can over-write value sessions with random values
- Big, big issue cause we can delete keys as well
- Could take over someones session using this endpoint
- Django, set_session function may be usable
- Safest solution is not to write this at all, do it in JS
- Described situation with Joao where auto-file removal after specific time
- Setup script running and removing files, problematic b/c it could fail in many scnearios
- Files are stored in S3, S3 api can be removed using expiry dates
- [ ] Possible solutions?
- [ ] General feedback?
- No permissions
- Assumed DRF, could consider a PATCH/PUT
- Not as important from security view point
- Second permission decorator, not enough validation, only checking for auth
- No ownership of specific session, would require adding something like IsSessionOwner
Second exercise on security architecture:
- Simple web app, but constructed with both customer and support engineer with easy access
- Most problematic risk is directly quering the primary database
- Need to ensure that DB is read-only, limited permission
- Put limitations on tables as well
- Worked with FTSE companies, disclosing financial data before public announcement could be criminal
- Second issue, everything under one subnet
- No network separation between web app and admin web app can use same network
- Access same database as well
- Consider splitting two services into different subnets
- So we can reduce the risk of sharing vulnerability of the web app and database
- If a service is forgotten and not updated, bugs could be shared and that creates a bridge to other environment
- Single EC2 instance, load balancer should be working with multiple EC2s so we can keep stability
- High load could be something that causes instability in a shared subnet
- Third, need read-replicas for database to handle admin access, limited write-access
- This could use a completely different database
- Support engineer should not access web app in same way as custoemr
- Setup limited VPC connection so admin app would be in safe subnet
- Customers can access via specific addresses
- For many years, instagram had open admin panel (django) to the public
- Fourth: Worker system processes freshly updated imports
- Have a clear pipeline of various workers
- Keep a data management pipeline so it's not easy to break the chain of file processing
- Worker overload, different queues for different type of tasks
- Allow clear failure with automated recovery or notification to avoid needing deep knowledge of data and process to debug
- AWS has rich permissions for S3, use access permission
- Client to collect logs and put them via encrypted connection to storage
- SIM or log aggregation which gateways should be allowed to send logs to the receiver
- Define internal gateways to narrow scope of where data can be sent
- We need to define how much we expect to generate and what sort of data
- TTL for document access
- Could consider situation where financial data could be protected even more
- Links could be asccessible only after logging in to the web app with 2FA
- Link should go through the web app panel to click again to get the limited TTL encrypted links to validate user access
- Customer set file passwords to limit internal employee visibility
- Microsoft offers Azure information protection, encrypt file
- No info about managing secrets or certificates from diagram, may need to add automated cert rotation, generating and establishment
- Could add different types of auditing and alerting systems
- Love the call out about potentially criminal liability for failure to secure financial data
- DDOS solutiosn like cloudflare or AWS Sheild are missing as well
- Automated anti-virus for malicious files?
- Consider requiring SSO for support engineers and/or customers for better auth security
- Scale and budget limits how secure you can make it
- Scale brings ddifferent threats