AWS Security for Technical Decision Makers

© 2018, Amazon Web Services, Inc. or Its Affiliates. All rights reserved.
Tom Whateley
Solution Architect, Amazon Web Services
AWS Security for
Technical Decision Makers

AWS Identity & Access
Management (IAM)
AWS Organizations
AWS Cognito
AWS Directory Service
AWS Secrets Manager
AWS Single Sign-On
AWS CloudTrail
AWS Config
Amazon
CloudWatch
Amazon GuardDuty
VPC Flow Logs
AWS Systems Manager
AWS Shield
AWS WAF – Web
application firewall
AWS Firewall Manager
Amazon Inspector
Amazon Virtual Private
Cloud (VPC)
AWS Key Management
Service (KMS)
AWS CloudHSM
Amazon Macie
AWS Certificate Manager
Server-Side Encryption
AWS Config Rules
AWS Lambda
Identity
Detective
control
Infrastructure
security
Incident
response
Data
protection
AWS Security Solutions

AWS CloudTrail
Enable governance, compliance, and operational/risk auditing of
your AWS account
AWS Config
Record and evaluate configurations of your AWS resources. Enable
compliance auditing, security analysis, resource change tracking,
and troubleshooting
Amazon CloudWatch
Monitor AWS Cloud resources and your applications on AWS to
collect metrics, monitor log files, set alarms, and automatically
react to changes
Amazon GuardDuty
Intelligent threat detection and continuous monitoring to protect
your AWS accounts and workloads
VPC Flow Logs
Capture information about the IP traffic going to and from network
interfaces in your VPC. Flow log data is stored using Amazon
CloudWatch Logs
Gain the visibility you need
to spot issues before they impact
the business, improve your
security posture, and reduce the
risk profile of
your environment.
Detective
control

AWS CloudTrail

What is AWS CloudTrail
AWS CloudTrail logs activity for supported services to an AWS account
Example API events that are logged:
• iam:CreateUser
• s3:ListBucket
CloudTrail is enabled by default on all AWS accounts (as of August 2017)
• Event history of create, modify, and delete operations for last seven days
• Viewable, searchable, and downloadable
To access CloudTrail log files directly or for a longer time period, create a trail

AWS CloudTrail log files
Gzipped JSON files declivered to a user-defined Amazon S3 bucket, containing records for one or more
API events
Each CloudTrail log file covers an approximately five-minute time window
Log files are encrypted by default
• Default is server-side encryption with Amazon S3-managed encryption keys (SSE-S3)
• Can configure encryption using AWS Key Management Service (AWS KMS)-managed keys (SSE-
KMS)
Optional log file integrity validation using signed digest file containing log-file hashes
• Digest file contains hashes for previous one hour’s worth of log files
Log files can stay in the S3 bucket for as long as you like
• Indefinitely by default
• Can use S3 bucket lifecycle policies to configure retention

AWS CloudTrail events
Each record in a CloudTrail log file represents a single event
All records contain some common fields:
• Time stamp
• Region
• Event name (i.e., the API call)
• Event source (i.e., the service)
• Source IP address
• User identity
Event-specific request and response parameters may also be included for some events

What do CloudTrail logs look like?
{ "Records": [{
"eventVersion": "1.0",
"userIdentity": {
"type": "IAMUser",
"principalId": "EX_PRINCIPAL_ID",
"arn": "arn:aws:iam::123456789012:user/Alice",
"accountId": "123456789012",
"accessKeyId": "EXAMPLE_KEY_ID",
"userName": "Alice”
},
"eventTime": "2017-11-29T11:29:42Z",
"eventSource": "iam.amazonaws.com",
"eventName": "CreateUser",
"awsRegion": "us-east-1",
"sourceIPAddress": "192.168.0.1",
"userAgent": "aws-cli/1.3.2 Python/2.7.5 Windows/7",
"requestParameters": {"userName": "Bob”},
"responseElements": {"user": {"createDate": ”Nov 29, 2017 11:29:42 AM", "userName": "Bob",
"arn": "arn:aws:iam::123456789012:user/Bob", "path": "/", "userId": "EXAMPLEUSERID"}
}
}]}

Amazon VPC Flow Logs

What is Amazon VPC Flow Logs
 Stores log in AWS CloudWatch Logs
 Can be enabled on
• Amazon VPC, a subnet, or a network interface
• Amazon VPC & Subnet enables logging for all interfaces in the VPC/subnet
• Each network interface has a unique log stream
 Flow logs do not capture real-time log streams for your network interfaces
 Filter desired result based on need
• All, Reject, Accept
• Troubleshooting or security related with alerting needs?
• Think before enabling All on VPC, will you use it?

VPC Flow Logs
• Agentless
• Enable per ENI, per subnet, or per VPC
• Logged to AWS CloudWatch Logs
• Create CloudWatch metrics from log data
• Alarm on those metrics
AWS
account
Source IP
Destination IP
Source port
Destination port
Interface Protocol Packets
Bytes Start/end time
Accept
or reject

© 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
VPC Flow Logs
• Amazon
Elasticsearch
Service
• Amazon
CloudWatch
Logs
subscriptions

Amazon Guard Duty

What is Amazon GuardDuty?
• A threat detection service re-imagined for the cloud
• Continuously monitors and protects AWS accounts, along with the
applications and services running within them
• Detects known and unknown threats (Zero-Days)
• Makes use of artificial intelligence and machine learning
• Integrated threat intelligence
• Operates on CloudTrail, VPC Flow Logs & DNS
• Detailed & Actionable Findings

Detecting Known Threats
Threat intelligence
• GuardDuty consumes feeds from various sources
• AWS Security
• Commercial feeds
• Open source feeds
• Customer provided threat intel (STIX)
• Known malware infected hosts
• Anonymizing proxies
• Sites hosting malware & hacker tools
• Crypto-currency mining pools and wallets
• Great catch-all for suspicious & malicious activity

Detecting Unknown Threats
Anomaly detection
• Algorithms to detect unusual behavior
• Inspecting signal patterns for signatures
• Profiling normal and looking at deviations
• Machine learning classifiers
• Larger R&D effort
• Highly skilled data scientists to study data
• Develop theoretical detection models
• Experiment with implementations
• Testing, tuning, and validation

What can Amazon GuardDuty detect?
Unusual Ports
DNS ExfiltrationRDP Brute Force
Temp credentials used off-instance
Unusual Instance Launch
Malicious or Suspicious IP Unusual Traffic Volume
Connect to Blacklisted SiteRecon Anonymizing Proxy
Unusual ISP Caller
Bitcoin Activity
Attempt to
compromise account
Probe API with temp
creds
RDP Brute
Force
Exfiltrate temp
IAM creds over DNS
RAT installed

AWS Config & Config Rules

AWS Config & Config Rules
A continuous recording and continuous assessment service.
Changing resources
AWS Config
Config Rules
History, Snapshot
Notifications
API Access
Normalized
Answer the questions:
How are my resources configured over time?
Is a change that just occurred to a resource compliant?

Configuration Item
Definition:
All configuration attributes for a given resource at a given point in time, captured
on every configuration change

Component Description Contains
Metadata Information about this configuration
item
Version ID, configuration item ID, time
when the configuration item was
captured, state ID indicating the
ordering of the configuration items of
a resource, MD5Hash, etc.
Common Attributes Resource attributes Resource ID, tags, resource type,
Amazon Resource Name (ARN)
Availability Zone, etc.
Relationships How the resource is related to other
resources associated with the account
EBS volume vol-1234567 is attached
to an EC2 instance i-a1b2c3d4
Current Configuration Information returned through a call to
the Describe or List API of the resource
For example, for EBS Volume
State of DeleteOnTermination flag,
type of volume, for example, gp2,
io1, or standard
Related Events The AWS CloudTrail events that are
related to the current configuration of
the resource
AWS CloudTrail event ID
Configuration Item

Sample Configuration Item
"configuration": {
"volumeId": "vol-ce676ccc",
"size": 1,
"snapshotId": "",
"availabilityZone": "us-west-2b",
"state": "in-use",
"createTime": "2014-02-……",
"attachments": [
{
"volumeId": "vol-ce676ccc",
"instanceId": "i-344c463d",
"device": "/dev/sdf",
"state": "attached",
"attachTime": "2014-03-",
"deleteOnTermination": false
}
],
"tags": [
{
"tagName": "environment",
"tagValue": "PROD"
Configuration

Sample Configuration Item
"configurationItemVersion": "1.0",
"configurationItemCaptureTime": "2014…",
"configurationStateID": “….",
"configurationItemStatus": "OK",
"resourceId": "vol-ce676ccc",
"arn": "arn:aws:us-west-………",
"accountId": "12345678910",
"availibilityZone": "us-west-2b",
"resourceType": "AWS::EC2::Volume",
"resourceCreationTime": "2014-02..",
"tags": {},
"relationships": [
{
"resourceId": "i-344c463d",
"resourceType": "AWS::EC2::Instance",
"name": "Attached to Instance"
}
],
"relatedEvents": [
"06c12a39-eb35-11de-ae07-db69edbb1e4",
],
Metadata
Common Attributes
Relationships
Related Events

Config Rule
• AWS managed rules
Defined by AWS
Require minimal (or no) configuration
Rules are managed by AWS
• Customer managed rules
Authored by you using AWS Lambda
Rules execute in your account
You maintain the rule
A rule that checks the validity of configurations recorded

Config Rules—Triggers
• Triggered by changes: rules invoked when relevant resources change
Scoped by changes to:
• Tag key/value
• Resource types
• Specific resource ID
For example, S3 Buckets with names containing “-private-” should never allow public read access
• Triggered periodically: rules invoked at specified frequency
For example, account should have no long-running EC2 instances tagged “bastion”; every 3 hours

Evaluations
The result of evaluating a Config rule against a resource
• Report evaluation of {Rule, ResourceType, ResourceID} directly from
the rule itself

Config Rules—Example
function evaluateCompliance(configurationItem, ruleParameters) {
if((configurationItem.configuration.imageId === ruleParameters.approvedImage1) ||
(configurationItem.configuration.imageId === ruleParameters.approvedImage2))
return 'COMPLIANT';
else return 'NON_COMPLIANT';
}
exports.handler = function(event, context) {
var invokingEvent = JSON.parse(event.invokingEvent);
var ruleParameters = JSON.parse(event.ruleParameters);
...
compliance = evaluateCompliance(invokingEvent.configurationItem, ruleParameters, context);
ComplianceResourceType: invokingEvent.configurationItem.resourceType,
ComplianceResourceId: invokingEvent.configurationItem.resourceId,
ComplianceType: compliance,
...
config.putEvaluations(putEvaluationsRequest, function (err, data)

AWS Security for Technical Decision Makers

Recomendados

Recomendados

Más contenido relacionado

La actualidad más candente

La actualidad más candente (20)

Similar a AWS Security for Technical Decision Makers

Similar a AWS Security for Technical Decision Makers (20)

Más de Amazon Web Services

Más de Amazon Web Services (20)

AWS Security for Technical Decision Makers