Security Roadmap

[bradleydwyer]

Next

• Design a security model #2448

Backlog

Access control

• Human Access, authorization to interact with CLI and console #2593
• AuthN/Z , module/verb level authorization #2594

Platform Identity

• Cryptographic Identity #2595
• Establish the concept of FTL cluster identity, ensure that parts of the cluster authenticate each other, required for AuthZ in the future. #2596
• Encrypted field annotations (for things like PII, etc.) on structs? +1 #2597
  • Could also be a custom FTL type like ftl.Optional but instead ftl.Encrypted. That might have a Decrypt() func that could be used to get the underlying value explicitly when needed.
  • Possibly add semantic type annotations to fields (compatible with https://prototype.sqprod.co/#/packages/squareup.governance.v0)
  • Challenge, can we keep sensitive data encrypted as long as possible while processing it through FTL. Require explicit Decrypt or “Access” calls to retrieve plaintext.
• Design+impl: encrypted field annotations (for things like PII, etc.) on structs? #2497
  • Could also be a custom FTL type like ftl.Optional but instead ftl.Encrypted. That might have a Decrypt() func that could be used to get the underlying value explicitly when needed.
  • Possibly add semantic type annotations to fields (compatible with https://prototype.sqprod.co/#/packages/squareup.governance.v0)
  • Challenge, can we keep sensitive data encrypted as long as possible while processing it through FTL. Require explicit Decrypt or “Access” calls to retrieve plaintext.

Encryption

• FTL controller payload encryption in the database - figure out keys #2598
  • Single key, with key derivation strategy for internal resources
• FTL logger safety , redaction support #2599
• Field Level encryption for PubSub (in general) #2600
• TLS between controller/runners #2601
  • Which will help with authentication and authorization of shared resources
  • Depends on where the security boundary is with platform
• Configurable Events, Pubsub, and other table retention periods? #2602

Infrastructure

• Egress control #2603
• Native support for security "zones"? DMZ, etc. #2604
• Allow existing secret infrastructure to be used internally in FTL. Maybe a "system" module? #2605
• Audit logging? Alex Szlavik #2606
• Secure + direct access to infrastructure, eg. allow direct secure "psql" access from laptop - this obviates the need to build custom systems in FTL Alex Szlavik #2607

KMS abstraction P2

• A separate module / or component (like a controller) which provides interfaces for performing cryptographic operations on key material. #2608