Upgrade to Pro — share decks privately, control downloads, hide ads and more …
Sign up for free

Heartbleed at Acquia

Avatar for Marc Seeger Marc Seeger
May 20, 2014
Technology
16k
0

Heartbleed at Acquia

A quick presentation on how we handled Heartbleed at Acquia. Held at a DevOps Boston meetup.

Avatar for Marc Seeger

Marc Seeger

May 20, 2014

More Decks by Marc Seeger

See All by Marc Seeger
Security in DECT
Avatar for Marc Seeger rb2k
2
220
The DIRAC video codec
Avatar for Marc Seeger rb2k
1
110
Communitygetriebene Android Systemerweiterungen
Avatar for Marc Seeger rb2k
1
70
Alternative infrastructure
Avatar for Marc Seeger rb2k
1
210
NoSQL Lunch and Learn
Avatar for Marc Seeger rb2k
9
8.6k
Lunch and Learn: Cucumber and Capybara
Avatar for Marc Seeger rb2k
7
22k

Other Decks in Technology

See All in Technology
AX時代の自治体支援リソース再配分と役割分担の再構成：戦略とロードマップ（概要）
Avatar for Sayaka Isizuka sishi2026
0
170
Oracle Database Security 詳細解説
Avatar for oracle4engineer oracle4engineer
PRO
1
200
Consistency for mere mortals - A gentle guide to consistency
Avatar for Uwe Friedrichsen ufried
0
120
[re:Invent2026事前勉強会(有志開催)]続きは、ラスベガスの廊下で / continue-in-the-vegas-hallway
Avatar for sh_fk2 sh_fk2
0
480
cdk deployとcdkd deploy、実際にデプロイして5倍速近くの差を実測した
Avatar for Yuuki Yamashita yama3133
1
160
Devin プロモコードの受け取りと適用(2026.10.27)
Avatar for kinopee kinopeee
1
820
複雑な業務システムを高速でつくるため、チーム全員をつくれる人へ
Avatar for AyaKurabuchi ayakurabuchi
0
120
アクセラレーターで実現するServiceNow活用の高速化 / ServiceNow World Forum 2026
Avatar for Visional Engineering ＆ Design visional_engineering_and_design
0
120
Deep Data Security 機能解説
Avatar for oracle4engineer oracle4engineer
PRO
3
990
[General] 개발자로 해외 기업에서 일하기
Avatar for Jaewoong skydoves
1
250
基本から分かる！AWSセキュリティ運用の考え方と任せ方
Avatar for cm-usuda-keisuke cmusudakeisuke
1
340
AIで選択肢が広がった組織設計の理想と現実
Avatar for konifar konifar
16
7.5k

Featured

See All Featured
Art, The Web, and Tiny UX
Avatar for Lynn Fisher lynnandtonic
304
22k
My Coaching Mixtape
Avatar for mlcsv mlcsv
0
370
Designing Dashboards & Data Visualisations in Web Apps
Avatar for Des Traynor destraynor
232
55k
"I'm Feeling Lucky" - Building Great Search Experiences for Today's Users (#IAC19)
Avatar for Dan Newman danielanewman
230
23k
Chrome DevTools: State of the Union 2024 - Debugging React & Beyond
Avatar for Addy Osmani addyosmani
10
1.4k
Git: the NoSQL Database
Avatar for Brandon Keepers bkeepers
PRO
433
67k
DBのスキルで生き残る技術 - AI時代におけるテーブル設計の勘所
Avatar for soudai sone soudai
PRO
68
59k
Measuring Dark Social's Impact On Conversion and Attribution
Avatar for Stephen Akadiri stephenakadiri
2
320
Fireside Chat
Avatar for paigeccino paigeccino
43
4.1k
Making the Leap to Tech Lead
Avatar for Ryan Cromwell cromwellryan
135
10k
Joys of Absence: A Defence of Solitary Play
Avatar for Sebastian Deterding codingconduct
1
570
Max Prin - Stacking Signals: How International SEO Comes Together (And Falls Apart)
Avatar for Tech SEO Connect techseoconnect
PRO
0
520

Transcript

  1. Marc Seeger (@rb2k)
 Boston Devops Meetup
 May 20th 2014 at

  2. Act 1: Technology

  3. How it all started 7:24 PM

  4. How it all started 7:30 PM

  5. How it all started 7:26 PM

  6. How it all started 7:33 PM

  7. How it all started

  8. Quick risk assessment Lucid: [00:35:27] [email protected]:~# openssl version OpenSSL 0.9.8k

    25 Mar 2009 ! Precise: [00:34:37] [email protected]:~# openssl version OpenSSL 1.0.1 14 Mar 2012

  9. Where’s Waldo OpenSSL 8000 EC2 Machines: - 99.9% of them

    puppetized - Candidates: - Balancers - SVN Servers - Appliances - ELBs - 3rd party AMIs - Unique little snowflakes
 (Jira, Crucible,…)

  10. Let the patching begin

  11. Rollout Australia: ! Con: - Spiders - Snakes ! Pro:

    - Ops is awake

  12. Rollout

  13. Scan www

  14. Waiting on ELBs…

  15. Internal Certificates

  16. Suddenly: “reverse” Heartbleed

  17. Act 2: Communication

  18. Internal • Pre-determined chat rooms • Dial-in conference bridges •

    A communication plan Thanks SSAE-16, PCI and FedRAMP… I guess :)

  19. Statuspage + Twitter * Powered by StatusPage.io *

  20. Documentation https://docs.acquia.com/articles/heartbleed-acquia-cloud

  21. Proactive communication Phone calls by Acquia support, TAMs, …

  22. Since then: Post mortem

  23. Since then: Incident Commander (shamelessly stolen from Heroku) http://en.wikipedia.org/wiki/Incident_command_system

  24. Since then: Dedicated resource to vet security threats

  25. Since then: Clean up intranet docs

  26. Since then: Additional tooling

  27. We’re hiring (shameless self promotion) bit.ly/acquiajobs