Philipp Krenn

Why should you allow all possible system calls from your application when you know that you only need some? If you have ever wondered the same then this is the right talk for you.

We are covering: * What is seccomp in a nutshell and where could you use it. * Practical example with Docker, Elasticsearch, and Beats. * How to collect seccomp violations with Auditd. Because your security approach can always use an additional layer of protection.

Why should you allow all possible system calls from your application when you know that you only need some? If you have ever wondered the same then this is the right talk for you. We are covering:

• What is seccomp in a nutshell and where could you use it.
• Practical example with Elasticsearch and Beats.
• How to collect seccomp violations with Auditd.

Because your security approach can always use an additional layer of protection.

Der Linux Audit-Daemon sammelt sicherheitsrelevante Aktivitäten, auf die man mit Hilfe von ausearch und aureport zugreifen kann. Das Analysieren und Zentralisieren dieser Datensätze ist allerdings nicht so einfach, wie man es erwarten würden. Der neue Auditbeat von Elastic behebt dies, indem er die ursprüngliche Konfiguration beibehält, die gesammelten Daten jedoch zentral speichern sowie einfach visualisieren kann.

Außerdem kann Auditbeat auch verwenden, um Änderungen an wichtigen Dateien, wie Binärdateien und Konfigurationsdateien, zu erkennen und mögliche Verstöße gegen Sicherheitsrichtlinien zu erkennen. Dieser Vortrag zeigt, was man tun kann, um Änderungen, Ereignisse und potenzielle Sicherheitsverletzungen auf interaktiven Dashboards so schnell wie möglich zu entdecken. Darüber hinaus kombinieren wir Auditd-Ereignisse mit Logs, die sicherheitsrelevant sind.

How do you build a lasting and successful company that also stays true to its open source roots? This talk takes a look at why open source is important to business and three essential elements of this path.

* Strategy: How can you monetize your open source product? Is it support, an open core approach, cloud services, or a combination of the three? And which ones are the features you can even commercialize without alienating your community? * Struggle: "You received a 100 million dollars in venture capital and yet you have so many open issues?!" Once money is involved the dynamics often change. How can you manage expectations and still build on a flourishing open source community? * Success: How do you balance open source and commercial success? How do you align engineering and sales decisions? This talk takes the perspective of Elastic, the company behind the open source products Elasticsearch, Kibana, Beats, and Logstash, which makes its money with support, the commercial extensions, and cloud offerings. But we are also taking a look at how others are approaching this challenge, what worked, and what failed.

The Linux Audit daemon is responsible for writing audit records to the disk, which you can then access with ausearch and aureport. However, it turned out that parsing and centralizing these records is not as easy as you would hope. Elastic's new Auditbeat fixes this by keeping the original configuration, but ships them to a centralized location where you can easily visualize all events. You can also use Auditbeat to detect changes to critical files, like binaries and configuration files, and identify potential security policy violations. This talk shows you what can you do to discover changes, events, and potential security breaches as soon as possible on interactive dashboards. Additionally, we are combining Auditd events with logs, which are security relevant.

New systems are always interesting targets since their security model couldn’t mature yet. NoSQL databases are no exception and had some lurid articles about their security, but how does their protection actually look like?

We will take a look at three widely used systems and their unique approaches:

• MongoDB: Widely criticized for publicly accessible databases and a common victim of ransomware. Actually, it provides an elaborate authentication and authorization system, which we will cover from a historic perspective and put an emphasis on the current state.
• Redis: Security through obscurity or how you can rename commands. And it features a unique tradeoff for binding to publicly accessible interfaces.
• Elasticsearch: Groovy scripting has been a constant headache, but the new, custom-built scripting language Painless tries to take the pain away literally.

Elasticsearch is a distributed, RESTful search and analytics engine built on top of Apache Lucene. After the initial release in 2010 it has become the most widely used full-text search engine, but it is not stopping there.

The revolution happened and now it is time for evolution. We dive into the following questions:

• How did leniency help the initial adoption, but why and how do we lean more on strictness today?
• How can upgrades be improved to avoid any downtime even when changing major versions?
• How can new resiliency features improve recovery scenarios and add totally new features?
• Why are types finally disappearing and how are we are trying to avoid the upgrade pain as much as possible?
• What are examples for some clever performance improvements?
• How can you shrink and (finally) split shards in a highly efficient way?

Attendees learn both about new and upcoming features as well as the motivation and engineering challenges behind them.