Demo: Cosmonic's WebAssembly Module for Security

Key Takeaways

[Music] and actions hey everyone here at the cloud native security conference hosted by the Linux Foundation we'll be doing demos here today and my first guest is Kevin Hoffman CTO and co-founder at cosmonic hi Kevin how are you doing pretty good you're going to give us a little demo as I understand so we're going to see cosmonic and I also want to hear about the advantages of webassembly with Cloud security okay and security overall we know that webassembly is allows for isolation and sandboxing we hear a lot of very traditional techniques being used by vendors in particular to approach security I would love to hear kind of this alternative view webassembly but let's take a look at cosmonic like you said one of the big benefits of webassembly is the sandbox and the isolation at the file level the web assembly module itself is completely isolated can't talk to the operating system uh can't talk to the host's memory uh that's all shared in sandbox that's all isolated and sandboxed and that's the the file level security then there's the runtime level security above that where you need a run time to run a web assembly model right and so whether that's a browser or whether that's uh you know like an edge mod runtime or wasm cloud or cosmonic those runtimes are responsible for enforcing higher level security and um the in the talk that I'm going through tomorrow in addition to the the core webassembly security the open source wasmcloud project adds another level of security on top of that and then uh cosmonic adds even more security as well as TurnKey hosting what is the uh do you think the deficiency in this approach that we're seeing with for instance with s-bombs for example yeah there's really two ways to to deal with this problem and it's either reactive or proactive right and a lot of the tools that we have now whether it's you know like the the docker notary or observability and management we we see when someone when the burglar is in the house you get notified when the door opens or the window breaks but there's nothing we can do really I mean there are precautions we can take but most of the time we're basically sitting back and waiting for someone to break in and then we catch them in the act right and what I like about the potential future that webassembly gives us is the fact that a vast majority of the attack vectors are just physically impossible on webassembly so instead of me sitting back and waiting to be told when someone's broken into my house I'm confident that under most conditions nobody's going to be able to break into my house anyway excellent well let's go through the cosmotic demo and perhaps you can provide some color on how this compares to other Solutions so for some context in case people aren't really all that familiar with webassembly uh what I have on this screen uh what I'm wiggling over here is a webassembly module that takes in a web request adds a number to a counter in a key value store and then gives me the data back so it's just a simple you know uh this is like your your classic hello world microservice the difference is that because this is a webassembly module I have an enormous amount of security built on top of that so when I when I click on this thing you'll see that this webassembly module has a public key which means it's been signed with uh you know asymmetric encryption so I can verify the issuer of every one of these webassembly modules I can verify when it was issued uh when the the signature expires all that stuff but in addition I can also verify that this thing is allowed to use a web server and it's allowed to use a key value store so you know you you sometimes you have tools at the really low level where you know you decide whether or not a microservice can use a particular socket or a particular Port yeah but at that level there's really nothing that tells you why it's using that Port okay some Services need access to TCP ports for benign reasons and so it's really hard to try without you know inspecting the content and all that stuff trying to block it at that level so at the webassembly runtime level we control whether or not this thing is allowed to use a web server or whether it's allowed to use a key Value Store okay and one of the other subtle benefits here is because this webassembly module can't actually talk to the operating system or you know make its own socket requests or have any interaction with the real Network it has to go through a um you could call it a side effect or a non-functional requirement but we we tend to refer to them as capabilities so this web server here is not actually part of my deployment product so in the the quote-unquote old way of doing things if I deploy a microservice the web server that I use is embedded in it the database that I use is embedded in it all of my dependencies are part of that package it's that phrase where you own your dependencies well in this case I can actually Swap this web server at runtime without my code ever knowing the difference I can swap in a real database for a test database or I can change from redis to Cassandra all at runtime because of the isolation from the webassembly module which you couldn't do in a traditional approaches but it will require a lot of configuration yeah so the way the the problem you generally have when you want to support something like that is if you're going to change from one database to another you have to go into your code change the client library and then refactor all of your stuff that used to the client library or you have to build all these you know bloated anti-corruption layers in the code but what we don't have to do is change our deployment artifact anymore and so in addition to you know like for the like the log for J vulnerability right right with that uh you know let's say there was uh vulnerability in one of these providers right now I can change that in the provider once and all of my deployed units uh that are currently running in production will automatically upgrade to the newest capability without me having to recompile refactor redesign or redeploy okay so is that the the the the foundation for what you offer at cosmonic yep so at the uh so at the bottom level you've got the core webassembly standards and then above that you have was implied the cncf open source project right that enables the um ability to build composable distributed applications out of webassembly modules right and then cosmotic lets you build them on uh infrastructure you don't have to manage and there's some other interesting stuff but you see how I've got this host here yeah this is an abstract concept of a host it's not actually like a physical thing it's not an easy two instance it's not a VM you can't even really say whether it's a firecracker or not but it's running inside cosmonic right if I if I had run this other command Cosmo up in my my on my laptop my laptop is now a part of cosmonic's infrastructure and I don't have to use complex tools like with kubernetes and uh telepresence and I don't have to deal with like vpns and proxies I can just stand up compute on my laptop verify that everything works move the compute into the cloud and then shut my laptop down and uh it's all set last question I have then is what's the barrier of entry for people with webassembly what what's going to tip it to like for do you think for for it to really kind of really take off and people see that value that you're talking about this may be uh an interesting opinion but I think when you're going to see that Tipping Point is when we no longer have web assembly dedicated conferences webassembly will be an implementation detail for right security and Dev tools and right and Cloud native and so it'll be you know just a check box you tick in vs code or something else okay once it hits that level of ubiquity then that's where the the Tipping Point's going to be we're already seeing some of the momentum gathered from uh you know companies like cosmonic and the evolution of some of the applications that you can run in the browser and so as more people start to realize webassembly is uh Cloud native tool more than a browser tool yeah and I think that's where yeah that's where the path is going to go Kevin thank you so much for taking the time oh no problem glad to be here if you like this video please give us a thumbs up and if you'd like to see more videos like this you can always subscribe to our YouTube channel we're on all the major social media platforms you can always find it's at the newestack.io we hope to see you soon foreign [Music]