Learn about how AWS security built a security knowledge management platform to distribute guidance at the scale of the AWS organization using Amazon API Gateway, AWS Lambda, Amazon RDS, and Amazon S3. This platform defines the AWS security bar and empowers AWS with the knowledge that is needed to build secure products and protect customer data. In this session, we look at how the content is consumed by tools and how it powers automated threat modeling for security reviews.

1. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
Building a security knowledge management
platform for AWS
Esha Pendharkar
Application Security Technical Program Manager
AWS
F N D 2 2 4

2. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
Agenda
Introduction to the AWS application security team
Journey to build a scalable security content management tool
Under the hood: System architecture
Automated threat model generation

3. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.

4. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
Introduction to the AWS application security team
Vision Design
Implemen-
tation
Launch Operations
Roadmap
discussions
Design
review
Security
testing
Integration
test cases
Production
scanning

5. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
Security design reviews
• Based on threat modeling
• Threat modeling: evaluating the assets and data flows of a system for potential
security issues, and determining the appropriate mitigations to prevent them

6. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.

7. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
The need for a security knowledge management platform
• The best guidance is actually guidance that no human needs to read and
understand
• We needed a scalable way to disperse that knowledge within our organization

8. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
What we built
We built a knowledge management platform that
• Defines the security bar
• Hosts security best practices

9. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
Content is king!
Recommendation
• Technology/service-agnostic best
practice
• Guidance to prevent a threat
• Parent of an implementation
Implementation
• Technology/service-specific steps on
secure development
• Technical mitigation for a threat
• Child of a recommendation

10. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
Sample user
interface

11. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
Sample
recommendation

12. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
Sample
implementation
(part 1 of 2)

13. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
Sample
implementation
(part 2 of 2)

14. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.

15. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
System architecture
AWS Lambda

16. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
APIs
• Return recommendations and implementations based on a tag
• Return only recommendations based on a tag
• Return only implementations based on a tag
• Return implementation by ID
• Return all implementations
• Returns recommendation by ID
• Return all recommendations
• Return threats list (more on this later!)
All of these APIs return output as JSON

17. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
Tagging
• Articles are assigned tags to assist with searching and querying
• Tags are specific services or technologies to which the guidance applies
• Examples include “compute”, “storage”, and “API”
• The “core” tag is applied to guidance that would apply to all or most services

18. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.

19. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
Automated threat model generation
Example
• Question: Select all services that your new feature uses
• Response: Amazon EC2 | Tag: “compute”
• Response: Amazon S3 | Tag: “storage”

20. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
Sample threat model
• Service: AWS knowledge management platform
• Design question: What services does your system use?
✓ AWS Lambda
✓ Amazon API Gateway
✓ Amazon RDS
✓ Amazon S3

21. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
Sample threat (1)

22. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
Sample mitigation (implementation)(1)

23. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
Sample threat (2)

24. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
Sample mitigation (implementation)(2)

25. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.

26. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
Recap
• The AWS application security team partners with product teams to hold a high
security bar for our customers
• Threat modeling helps identify and mitigate issues before they are introduced
• To scale threat modeling within AWS, the AWS application security built a
security knowledge platform to automate threat model generation and enable
engineers to launch secure products to our customers!

27. Thank you!
© 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.