Kong DevopsSpeakeasy at Kong Summit 2022, 29 Sep 2022

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: #DevOpsSpeakeasy at #kongsummit22 with Stepan Ilyin

Description

Restream helps you multistream & reach your audience, wherever they are.

A

Stop pushing now and we're all people we're all doing mistakes so, like eventually, you have a lot of vulnerable code in production right and I buy like all these companies that are here, everybody has vulnerable code in production so, like you need to have something they can actually analyze all the traffic and try to figure out like when somebody's trying to find vulnerabilities when somebody's trying to expose this vulnerabilities- and this is really hard- that's really hard to do so like one of the challenges is actually how you can do it real time, because you not only need to do the standard things that API management or API Gateway needs to do, but you also need to parcel the requests applied.

A

Egg detection make it a decision like if this particular request is in malicious or not block it in case you need like, if you believe it's malicious thing, so it's really really hard to do on scale, especially like we have customers like Dropbox, mirror they analyze like billions of requests daily, and so it's really really hard to do on scale. So that's why you need help okay,.

B

Different kind of solutions, all right so I, understand and take some tool, magic tool that does.

A

B

I like alarm and and what what happens, how do you, how can you Analyze, This skill and not only make sure that you find and block the better quests, but also prevent false positives and don't block traffic that was completely legitimate and you decided for some reason that it's something off with that.

A

Oh yeah, yeah false positives. Are it's actually not a big challenge? Not only have people doing it fast but like how to do it accurately, though, so, like we put a lot of efforts in that direction, so at the end of the day, it's all about like how we approach the attack detection and obviously what you don't want to use is signatures. You know like this very basic, regular based rules wouldn't have a match, uh with some kind of like database of the bad payloads at least again like so outdated.

A

Unfortunately, this is what a lot of companies still sell. So you don't want to use that so, like we use a behavioral based analytics with grammar base. Attack detection is basically when you think about the compiler. You basically need to create a compiler that understands the source code. We created a compiler that actually understands what is the attack, so basically describe the grammar of attack. So this is one of the things we actually open sort. You can find it at GitHub.

A

It's called leap detection, so it's purely grammar based attack detection technique, so they can find injection attacks commanding attacks. So like it's out there but get into your question like what we do like we do. Three things. One is APA discovery: how even to find all the apis that you have like every time we talk with a customer companies. We ask simple question: how many API endpoints do you have do you know like? Do you think everybody can ask answer.

B

That I'm sure I'm sure like it's it's a.

B

Opposing probably obsolete, Legacy and vulnerable code, because no one knows that those apis exist, but at least here a centralized API management like Conga, actually solves this problem.

A

I mean Kong solved a problem for those apis that are managed with Kong. But if you have like other apis that are not managed by accounts, or they are not even managed by any API Gateway which, by the way like Gardner, is saying like by 2024, half of the apis wouldn't be managed by anything. So like that.

B

Let's expand this number to get lower.

A

Aspect, this is the reality you just like have so many apis they're changing all the time like nobody have a good understanding of what is happening out there so like having an inventory. This is a challenge number one and we kind of herself to solve.

B

It and you do it by scanning the networks and discovering all the endpoints.

A

Two things: like one thing: we can do the outside, so you're, giving us a domain like uh kong.com right and like we can basically find everything that you have exposed. Like all subdomains, we will look like whatever what is cached and Google this kind of stuff, uh but it's not enough. So basically you need to analyze the traffic and we could like do it like in a multiple ways.

A

We can sit right within the Kong, so basically we'll analyze all the traffic of Kong, which is one thing, but the challenge here is that, like not, everything is running through the Conch.

A

So that's why we use out of band approach as well and we can have a copy of the traffic from Amazon or from your load balancers or from other Cloud providers, so basically analyze the copy of all the traffic and build a whole profile, like all the apis, all the endpoints, all the parameters which of them expose sensitive data which of them authenticated, which of them are not so like. That's that's the approach. Okay,.

B

So we got, we got the list of foreign ticated or not, and we can and I think this is a first great step to actually make sure that all your apis are managed correctly right.

A

B

Think um alarm do this discovery and then make sure that each and every API go through my API Gateway and then.

A

B

Makes it more secure, by definition that I have the centralized management of those apis, but it's not enough. It's.

A

B

Okay, so what's next.

A

That's a good start now. You know like at least what do you have out there now you need to now you're, not sleeping advice and thinking how on Earth we can protect all those thousands of apis. We have yeah like this is where, like com can help, you know, like you make. You need to make sure like all of them authenticate it. You need to make sure that you put the rate limiting.

A

You can do it with Kong or other air API Management Systems, uh but at the end of the day, you also need to think like how to make sure that your apis are not abused and how to make sure that they are not breached right now. This is where you can like. You can also use some open sources by the way so like whether it's a kind of webs out there web is a web application firewall. They can do something but they're, very simple kind of like this.

A

Regular expression based approach are at least better to have something than.

B

Not having anything but.

A

At the end of the end of the day, you need some spidery solution that can actually analyze all of the protocols that you have like res graphql, grpc, uh everything that is out there web sockets. You need to make sure that your solution for security actually supports all those protocols and by support I mean like it can parse it can analyze and it can like mitigate all those effects so basically and a disaware yeah. This is where you need some product that can actually the best case sits in line.

A

So they can, you know not only detect stuff by analyzing copy of the traffic. This is whatever what a lot of companies are doing, but also like sitting inline, so that you can actually block them right away. Excellent.

B

All right so folks, you take a look at valarm and learn more about API security and how to make them even more secure that you have make sure that you manage them using a good API Gateway like on. Hence the one thank you for coming for today, we'll Speak Easy.

A

Awesome, thank you for having me.