GeeCON 2018: Daniel Sawano - Creating secure software - benefits from cloud thinking

## Overview Daniel Sawano from Avanza Bank (Stockholm) presents how cloud-native principles can improve application security regardless of deployment location. He draws from 12-factor app methodology and cloud-native thinking to propose three key architectural changes: configuration management, stateless processes, and logging-as-a-service, culminating in the 3 R's of enterprise security framework.

## Key Topics

### Configuration in Environment Instead of hardcoding secrets or storing them in configuration files on disk, move passwords and access keys to environment variables. This shifts secret management responsibility to the platform/centralized service, reduces exposure to developers, enables audit trails, and enables ephemeral secrets (short-lived credentials stored only in RAM). While the platform must still protect secrets at rest, this design pattern forces intentional security thinking.

### Stateless Processes Run multiple instances of the application as stateless processes communicating only through backing services (databases, caches, message queues). This approach enables: - **Availability**: Kill off compromised instances without data loss - **Integrity**: Replace bad instances with fresh ones - Separation of deployment (privileged user) from runtime (dedicated unprivileged user per application) - Principle of least privilege: processes have only necessary permissions

### Logging as a Service Instead of logging to disk files, send logs to a centralized logging service. This solves security challenges: - **Confidentiality**: Service enforces authorized access (addresses GDPR concerns about sensitive data in logs) - **Integrity**: Logs can be treated as read-only, digitally signed to detect tampering - **Availability**: No disk space issues; dedicated team manages storage and rotation

### The 3 R's of Enterprise Security Justin Smith (Pivotal) coined this framework inverting traditional enterprise security (minimize change) to maximize change as a defense against Advanced Persistent Threats (APTs). Time favors attackers; constant change starves them.

**Rotate** (every few minutes/hours): - Secrets expire quickly, limiting attack window - Use services like HashiCorp Vault to inject new credentials - Applications can passively receive rotated secrets or actively fetch them - Apply to passwords, tokens, certificates

**Repave** (at least hourly): - Recreate servers/containers from fresh base images - Kills any malicious software; completely destroy instances (including temp files) - Use rolling deployments for zero downtime - Deploy even without code changes for security benefit

**Repair** (within hours of patch release): - Deploy patches as new known-good states - Always recreate from scratch, not incremental updates - Monitor and update third-party dependencies - Use CI/CD integration (e.g., Jenkins plugins) to detect dependency vulnerabilities - Automated processes enable fast verification

## Technical Details The CIA security model (Confidentiality, Integrity, Availability) frames analysis. Design patterns mentioned include wrapper objects for sensitive data and secure toString() methods to prevent accidental log leakage. For legacy applications with connection pools, compromise by allowing longer password validity (e.g., one hour) while still repaving to retain some security benefit. Admin tasks should become dedicated APIs running as separate processes, not terminal/SQL commands, limiting scope and keeping administration logic aligned with application code.