Loscon Notes

auth.md

User Auth

• rate limiting
• cryptographically secure tokens (not rand() or guid())
• expire sessions

workflows

account creation

• sanitize for xss
• validate ownership of email
• normalize case sensitivity
• unique per user / per application salt with hash (bcrypt / scrypt... but maybe not)
  • break up data (one store for salt, one for hash, one (app config?) for iterations)

forgot password

• !password restore
• reset tokens are one-use and expire fast

et.al.

• Apache Shiro Framework (authentication)
• 2 factor
• last login time / geo info

gauntlt.md

Gauntlt

@wickett

tenets of gauntlt

• facilitate communication between infosec, dev, ops
• shift from compliance driven to auditor led security
• a new language and currency in organizations

rugged software development

• repeatable
• reliable
• reviewable
• rabid
• resilient
• reduced

securing big data.md

Securing Big Data

Big Data

• volume
• velocity
• variety

(secondary)

• distributed
• resilient
• no hardware constraints

NoSQL

• cassandra (AP)
• mongodb (CP)
• hbase (CP)

Security

afterthought

Nature of big data

• ownership, privacy, integrity

  • hard to identify sensitive data
  • liability & litigation
  • prone to insider attacks

• provenance issues... origination & ownership

• traditional controls are ineffective

Deployment

• large attack surface
• rogue nodes
• difficult to determine data "loss"
• non-traditional security needs
• security scalability concerns

Not designed with security in mind

• multiple communication protocols
• multiple authentication mechanisms
• multiple end-points (apis, nodes, webapps)
• default is no security

Kerberos

• provides authentication for hadoop

  • RPC connections
  • SPNEGO for HTTP web access

• mutual authentications for users & services

• utilizes SASL

• can configure HDFS with encryption

• SSL for web traffic (Oozie)

downsides

• hard to configure
• hard to implement
• no root access to cluster or job launcher machines
• no communication over untrusted networks
• still no encryption at rest

Practical Steps

Cassandra

• write an auth/auth plugin (configure in cassandra YAML file)
  • authorization granularity: keyspace & column family
• v1.2 has internal authentication
• enable node-node encryption
• enable client to node encryption
• optionally, enable disk support for encryption

hadoop