will web 2.0 applications break the cloud?

Rich Web applications 2011Crashing in the cloud

Danny Liebermandannyl@software.co.ilhttp://www.software.co.il/wordpress/ 

Copyright Creative Commons Attribution License by Danny Lieberman

Course Content

Preface Security Performance The future Summary

Preface

Cloud computing is fashionable.

Ralf Lauren Fall 2010

Preface

But what about performance & security?

Coco Chanel circa 1920

Cloud and the “security problem”

Why is security so hard to sell today? Complex Hard to understand Economic benefit to business unclear

Cloud and the “security problem”

Computing as a utility– Simple

– Easy to measure economic benefit

– Security is built-in

Cloud and the “security problem”

The good news– The Tier 1 providers are better at security

than you or me

The bad news– You still have application software– Just with a bigger threat surface

The cloud threat surface

CIO mistakes Application software

The top 3 mistakes CIOS make

No knowing how much your assets are worth asset.val()== undefined

Writing procedures while attackers exploit your software $p != security.software

Confusing compliance with data security $c != security.data

Rich Web 2.0 applications 2011

Browser Smartphone

Server stack

2-5 languagesMessage passing in the UI

3-5 languagesMessage passing in the UI

PC Device

Message passing in the UI?

Very bad idea.

Worst dressed at BET Awards 2010

Rich Web 2.0 entry points

Browser Smartphone

Server stack

DB ServersInterfacesPHP, C#, Ruby, J2EEHTML/Javascript/CSSWeb servers

HTMLXMLCSSJavascriptJavaFlash

PC Device

Rich Web 2.0 attack scenarios

Any kind of code injection

Server or client returns invalid HTML

Pages contain dead links

HTML forms don't match field types expected by controllers

Client side makes bad assumptions about AJAX services

Server may attempt to execute invalid SQL queries

Improper marshaling/un-marshaling

– DB server to Web server

– DB server to application tier

– Web server to browser

Rich Web 2.0 vulnerabilities

Heterogeneous stacks

– Too much chewing gum

PHP, Ruby, Python

– Flexibility, no static type guarantees

C#, Java

– Static typed, but only at Web server

– Code complexity increases threat surface

Redundant code on servers and clients

Redundant data on servers and clients

Client-server latency

– Slow HTTP POST attacks

Cloud security reference model

Security summary

Security Control model looks great But doesn't mitigate core vulnerabilities

Typing issues Interface issues Redundant code, data and tiers Client-server latency

Performance - time is money

Amazon.com 100 ms of latency costs Amazon 1% of sales

(http://highscalability.com)

Google.com 500ms delay in delivery is a 20% drop in

traffic (Google VP Marissa Mayer)

Competing stock trading platforms 5ms delay is $4M in losses / ms.

Web servers 2011

Browser opens connection.

Server forks a thread for each connection, using blocking IO.

Ajax latency: 200-600ms

Hardware 2011

What about multiple-processor concurrency?

Threads don't scale well with multi-cores

Processes are necessary to scale to multi-core computers, not memory-sharing threads.

Threads are a bad idea

The mixture of threads and modern multi-core systems add up to some serious race condition potential.http://blogs.msdn.com/b/david_leblanc/archive/2007/04/19/why-threads-are-a-bad-idea.aspx

Thread-based networking is inefficient and very difficult to use. http://www.kegel.com/c10k.html and http://bulk.fefe.de/scalable-networking.pdf

The future of apps in the cloud

The fundamentals of scalable systems are fast networking and non-blocking design—the rest is message passing.

The fundamentals of scalable systems are fast networking and non-blocking design—

the rest is message passing.

3 technologies will be game changers,I think...● Web sockets● Node JS● Couch DB

The future of apps in the cloud

Web sockets

Open a connection to Web server

It stays open Pass messages Eliminates at least 2

processes for every connection.(Browser-Server & Server-Database)

Low Latency: 20-60ms instead of 200-600ms

The future of apps in the cloud

Node.js

Javascript on client and server

No threads No blocks or locks UI is HTML & CSS

Asynchronous message passingwith Web sockets

The future of apps in the cloud

CouchDB

Application served out of CouchDB CouchApp lives in the browser. No middle tier Javascript on client and server UI is HTML & CSS CouchDB uses Ajax to shove

JSON back and forth. CouchDB replicates on smart phones

Summary

Application vulnerabilities are expensive 100x more expensive to fix after implementation Potential data loss in the cloud Security controls don't come cheap

Time is money High latency applications less responsive Your cloud provider charges per CPU cycle Your costs go up, revenue goes down

Promising new technologies No middle/data tiers, reduced threat surface 10x lower latency Your costs go down, revenue goes up.