AWS bastions and assume-role
engineering.coinbase.com
AWS bastions and assume-role
1–10 of 68 posts
Re: AWS bastions and assume-role
#2As coinbase is a Bitcoin wallet and they transact a lot of money it suprises me that they reveal details of their implementation publicly.
Edit - Getting downvoted a lot.
Seems that some people think that the expression 'You shouldn't rely on security through obscurity' means that it's OK to publish your backend infrastructure.
Best practice is defence in depth.
That means you secure everything including your implementation details.
If a zero day is found in any of their stack, they're a google search away from being found for that.
Re: AWS bastions and assume-role
#3As coinbase is a Bitcoin wallet and they transact a lot of money it suprises me that they reveal details of their implementation publicly. Edit - Getting downvoted a lot. Seems that some people think that the expression 'You shouldn't rely on security through obscurity' means that it's OK to publish your backend infrastructure. Best practice is defence in depth. That means you secure everything including your impleme…
People say that security trough obscurity is not a good idea.
Re: AWS bastions and assume-role
#4As coinbase is a Bitcoin wallet and they transact a lot of money it suprises me that they reveal details of their implementation publicly. Edit - Getting downvoted a lot. Seems that some people think that the expression 'You shouldn't rely on security through obscurity' means that it's OK to publish your backend infrastructure. Best practice is defence in depth. That means you secure everything including your impleme…
Coinbase is not the only company doing this. This is actually best practice.
Re: AWS bastions and assume-role
#5As coinbase is a Bitcoin wallet and they transact a lot of money it suprises me that they reveal details of their implementation publicly. Edit - Getting downvoted a lot. Seems that some people think that the expression 'You shouldn't rely on security through obscurity' means that it's OK to publish your backend infrastructure. Best practice is defence in depth. That means you secure everything including your impleme…
People say that security trough obscurity is not a good idea.
Keeping the details of your security setup secret or obscure is not security through obscurity.
Security trough obscurity is using the secrecy of your security setup as a pillar of that security.
It's perfectly sane to keep the details secret even if those details themselves don't form part of your security.
Re: AWS bastions and assume-role
#6As coinbase is a Bitcoin wallet and they transact a lot of money it suprises me that they reveal details of their implementation publicly. Edit - Getting downvoted a lot. Seems that some people think that the expression 'You shouldn't rely on security through obscurity' means that it's OK to publish your backend infrastructure. Best practice is defence in depth. That means you secure everything including your impleme…
This is actually a best practice and I believe Amazon also advises this. So it's not really something secret. For me as a customer it is good to know they follow these practices and communicate their understanding of it outwards.
For private projects I have been experimenten with how far I can go in open sourcing everything (including server configuration) and where you hit limits. Example project: https://gitlab.com/failmap/server
Diving into a project with a open source mindset really makes me think more about security topics from a different angle and find better solutions. Like reducing the secrets that must be known (and thus can leak), like user/database passwords. Instead of security by obscurity there is nothing to obscure.
Re: AWS bastions and assume-role
#7In Google Cloud, something like this is mostly unnecessary. The project model scopes resources to a particular project within an organisation, rather than all resources being global to the account. This gives a really good first cut at isolating different environments and projects.
Re: AWS bastions and assume-role
#8As coinbase is a Bitcoin wallet and they transact a lot of money it suprises me that they reveal details of their implementation publicly. Edit - Getting downvoted a lot. Seems that some people think that the expression 'You shouldn't rely on security through obscurity' means that it's OK to publish your backend infrastructure. Best practice is defence in depth. That means you secure everything including your impleme…
Good security doesn't require obscurity.
Re: AWS bastions and assume-role
#9As coinbase is a Bitcoin wallet and they transact a lot of money it suprises me that they reveal details of their implementation publicly. Edit - Getting downvoted a lot. Seems that some people think that the expression 'You shouldn't rely on security through obscurity' means that it's OK to publish your backend infrastructure. Best practice is defence in depth. That means you secure everything including your impleme…
This is actually a best practice and I believe Amazon also advises this. So it's not really something secret. For me as a customer it is good to know they follow these practices and communicate their understanding of it outwards. For private projects I have been experimenten with how far I can go in open sourcing everything (including server configuration) and where you hit limits. Example project: https://gitlab.com…
The first step of an attack is reconnaissance.
How is making that step very easy for an attacker best practice?
Re: AWS bastions and assume-role
#10Earlier quoted context omitted.
This is actually a best practice and I believe Amazon also advises this. So it's not really something secret. For me as a customer it is good to know they follow these practices and communicate their understanding of it outwards. For private projects I have been experimenten with how far I can go in open sourcing everything (including server configuration) and where you hit limits. Example project: https://gitlab.com…
The first step of an attack is reconnaissance. How is making that step very easy for an attacker best practice?
If the only thing keeping your attacker out is that they can't do recon then you're kinda boned.
Security through obscurity and all that.