(DVO207) Defending Your Workloads Against the Next Zero-Day Attack
"When serious vulnerabilities like Shellshock or Heartbleed are discovered, you know you should respond quickly. But when you’re juggling many priorities and are more comfortable developing apps than security policies, emergency updates may fall to the bottom of the list. Is there a better way to protect your workloads without a lot of work? In AWS, your entire deployment and infrastructure is code. Your security controls have to take the same approach. When your entire stack is code, you can automate protection for zero-day vulnerabilities, without impacting your architecture or adding operational burden. In this session, you’ll learn how to respond and recover from the next zero-day vulnerability. Using real-world examples, you’ll see how you can combine AWS features, such as security groups, VPCs, and IAM roles with workload-aware security controls like intrusion prevention to automate your defenses. Learn simple and easy-to-deploy security techniques that protect your workloads, but don’t require a PhD in cybersecurity. Session sponsored by Trend Micro."
Recomendados
Recomendados
Más contenido relacionado
Destacado
Destacado (20)
Similar a (DVO207) Defending Your Workloads Against the Next Zero-Day Attack
Similar a (DVO207) Defending Your Workloads Against the Next Zero-Day Attack (20)
Más de Amazon Web Services
Más de Amazon Web Services (20)
Último
Último (20)
(DVO207) Defending Your Workloads Against the Next Zero-Day Attack
- 1. Defending Your Workloads Against the Next Zero-Day Attack DVO207 Mark Nunnikhoven, Trend Micro October 2015
- 4. 2012 re:Invent Cloud Security Is a Shared Responsibility SPR203 : http://bit.ly/2012-spr203 2013 re:Invent How to Meet Strict Security & Compliance Requirements in the Cloud SEC208: http://bit.ly/2013-sec208 How Trend Micro Build Their Enterprise Security Offering on AWS SEC307: http://bit.ly/2013-sec307 2014 re:Invent Updating Security Operations for the Cloud SEC313(R): http://bit.ly/2014-sec313 Customer Perspectives on Implementing Security Controls with AWS SEC314: http://bit.ly/2014-sec314 2015 re:Invent Lessons from a CISO: How to Securely Scale Teams, Workloads, and Budgets DVO206: http://bit.ly/2015-dvo206 Defending Your Workloads Against the Next Zero-Day Attack DVO207: http://bit.ly/2015-dvo207
- 5. Resiliency
- 6. Even when there is patch, average time to deploy is 176 days It’s a problem now No long-term fix Evolving situation Zero-day
- 7. by Andreas Linch (@addelindh)
- 8. bash is a command line interpreter
- 9. 10 | 10 vulnerability. Widespread & easy to exploit. a:() { b; } | attack [ your data ]
- 14. Event Timeline Event Action Action Timeline 1989-08-05 8:32 Added to codebase +27 days, 10:20:00 Release to public 9141 days, 21:18:35 Initial report React Clock starts 1 day, 22:19:13 More details React 2 days, 7:30:12 Official patch :: CVE-2014-6271 Patch 4 days, 5:49:25 5 days, 9:16:35 Limited disclosure :: CVE-2014-6271 React 2 days, 4:37 More details React
- 15. Event Timeline Event Action Action Timeline 1989-08-05 8:32 Added to codebase +27 days, 10:20:00 Release to public 9141 days, 21:18:35 Initial report React Clock starts 2 days, 7:30:12 Official patch :: CVE-2014-6271 Patch 4 days, 5:49:25 3:29:09 Official patch :: CVE-2014-7169 Patch 9 days, 19:17:00 3:15:00 Official patch :: CVE-2014-7186, CVE-2014-7187 Patch 4 days, 17:30:00 1 day, 11:55:00 Official patch :: CVE-2014-6277 Patch 1 day, 11:55:00 2 days, 20:24:00 Official patch :: CVE-2014-6278 Patch 2 days, 20:24:00
- 16. React
- 17. http://aws.amazon.com/architecture: Web application hosting reference architecture
- 18. http://aws.amazon.com/architecture: Web application hosting reference architecture
- 19. Primary traffic flow TCP:443 TCP:443 TCP:443 TCP:443
- 21. More in the Auditing Security Checklist for Use of AWS AWS IAM roles Security groups Network segmentation
- 22. Primary traffic flow TCP:443 TCP:443 TCP:443 TCP:443
- 24. http://aws.amazon.com/architecture: Web application hosting reference architecture
- 26. More in the Auditing Security Checklist for Use of AWS You All instances protected Workload-specific rules Centrally managed
- 27. Resolve
- 28. Primary traffic flow TCP:443 TCP:443 TCP:443 TCP:443
- 29. Deploy all Amazon EC2 instances from base AMI or build on the fly
- 31. 4. Destroy 1. Change 2. Test 3. Promote [ Production ][ Production ]
- 32. http://aws.amazon.com/architecture: Web application hosting reference architecture
- 35. Resiliency
- 36. Follow @marknca for more… ResolveReact Deploy green/blue Integrity monitoring Operational Technique Real-time control Review configuration Intrusion prevention Operational Technique Real-time control
- 37. Follow @marknca for more…