The document discusses security at scale on AWS. It covers several topics: - AWS security controls including over 70 services, 7,710 audit artifacts and 3,030 audit requirements. - How AWS handles security at scale through automation, ubiquitous logging and encryption, and rapid detection and response times of under 10 minutes on average. - AWS services that can help with security including IAM, CloudTrail, GuardDuty, and AWS Config rules. - Reference architectures that show how to scale infrastructure securely including using multiple availability zones and services like Route 53, S3, CloudFront, and Lambda.

1. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Dave Walker – Specialist Solutions Architect, Security and Compliance
Timothy Stranex – CTO, Luno
05/07/17
Security at Scale on AWS

2. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Agenda
• AWS, Approaches and Controls
• AWS and Human Factors
• How AWS Handles Security at Scale
• AWS controls that you don’t need to worry about
• Framework to help you adapt the cloud Faster
• AWS Services that you should be Using
• Reference Architectures that you can Use
• Timothy @ Luno!

3. Approaches Adopted by Successful Security Programmes
Ubiquitous
encryption
Just-in-time
access
Ubiquitous
logging
DevSecOps
Security
services and
API
Security
programme
Security as
code
Minimum
security
baseline
Asset
management
Security
management
layer

4. AWS Security Controls
70+
services
7,710 Audit
Artifacts
3,030 Audit
Requirements
2,670
Controls

5. AWS Security Team
Operations
Application Security
Engineering
Compliance
Aligned for agility
Human Factors

6. Security Ownership as Part of DNA
Promotes culture of “everyone is an owner” for security
Makes security stakeholder in business success
Enables easier and smoother communication
Distributed Embedded

7. Operating Principles
Separation of duties
Different personnel across service lines
Least privilege

8. Technology to Automate Operational Principles
Visibility through log analytics
Shrinking the protection boundaries
Ubiquitous encryption

9. How AWS Handles Security at Scale
Work
generator
Corp
S3
Results
processor
SNS
Lambda
(async)
Scan target
Lambda
(sync)

10. How Fast is the Analysis?
• Scan cadence: continual! (not batch)
• Mean time to detect & respond = ~7.5 minutes
• ~5 min for CloudTrail log file to be produced
• ~0 min for scan to begin (on order of seconds!)
• ~0 min scan time (on order of milliseconds!)
• ~2.5 min for results processor to ticket (runs every 5 min*)
• Worst case: ~10 minutes
• Best case: ~5 minutes

11. Autoticketing
• Find and close gaps in security monitoring
• Be highly accurate and actionable
• Deliver results with low latency

12. How we make it even faster?
• Drink our own ale! CloudWatch Events
• Increase result processor run frequency
• It takes < 1 minute per run on average
• Change invocation to run every minute
• New worst case = 1 minute
• MTTD ≤ 1 minute
• (For your own use: see eg https://github.com/capitalone/cloud-
custodian )

13. I wish I was a Solid
State Drive in
someone else’s
Datacentre…

14. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
AWS Security Controls
AWS Foundation Services
Compute Storage Database Networking
AWS Global
Infrastructure Regions
Availability Zones
Edge locations
Your own
accreditation
Your own
certifications
Your own
external auditsCustomerAWS
Customer scope
and effort is reduced
Better results
through focused
efforts
Built on AWS
consistent baseline
controls

15. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
AWS Cloud Adoption Framework
• Each Perspective provides
guidance for different
parts of an organization
• Helps YOU adapt existing
practices or introduce new
practices for cloud
computing

16. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
The Security Journey to the Cloud
Security in the cloud is familiar.
The increase in agility and the ability to perform actions faster,
at a larger scale and at a lower cost, does not invalidate well-
established principles of information security.

17. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
The AWS CAF Security Perspective
5 Core Capabilities
Identity and Access Management
Detective controls
Infrastructure security
Data protection
Incident response

18. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Scaling to >1 Million Users
RDS DB Instance
Active (Multi-AZ)
Availability Zone
Load
balancer
RDS DB Instance
Read Replica
RDS DB Instance
Read Replica
Web
Instance
Web
Instance
Web
Instance
Web
Instance
Amazon
Route 53
User
Amazon S3
Amazon
CloudFront
DynamoDB
Amazon SQS
ElastiCache
Worker
Instance
Worker
Instance
Amazon
CloudWatch
Internal App
Instance
Internal App
Instance Amazon SES
Lambda

19. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Security Already Built In…
Security groups are
virtual firewalls
that control the
traffic for one or
more resources
IAM securely
controls access to
AWS services and
resources for your
users.

20. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Identity and Access Management
AWS
Organizations IAM
AWS Security Token
Service

21. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Detective Controls
AWS
CloudTrail
Amazon
CloudWatch
AWS Config
Amazon
Inspector
VPC Flow Logs
Account Resources Network

22. If it moves…log it!

23. If it moves…log it!
(If it doesn’t move, watch it ‘til it
moves – then log it!)

24. Logs→metrics→alerts→actions
AWS Config
CloudWatch /
CloudWatch Logs
CloudWatch
alarms
AWS CloudTrail
Amazon EC2 OS logs
Amazon VPC
Flow Logs
Amazon SNS
email notification
HTTP/S
notification
SMS notifications
Mobile push
notifications
API calls
from most
services
Monitoring data
from AWS
services
Custom
metrics

25. Different log categories
• AWS infrastructure logs
 AWS CloudTrail
 Amazon VPC Flow Logs
• AWS service logs
 Amazon S3
 Elastic Load Balancing
 Amazon CloudFront
 AWS Lambda
(sometimes)
 AWS Elastic Beanstalk
 …
• Host-based logs
 Messages
 Security
 NGINX/Apache/
 Syslog etc
 Performance Monitoring
 …
Security-related events

26. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Detective Controls - VPC Flow Logs

27. Flow Log Record Structure
Event-Version
Account Number
ENI-ID
Source-IP
Destination-IP
SourcePort
Destination-Port
Protocol Number
Number of Packets
Number of Bytes
Start-Time Window
End-Time Window
Action
State
2 123456789 eni-31607853 172.16.0.10 172.16.0.172 80 41707 6 1 40 1440402534 1440402589
ACCEPT OK

28. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Infrastructure Security
AWS OpsWorks
AWS Shield
AWS WAF
Resources Network
AWS Trusted
Advisor
AWS Config
Rules

29. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Infrastructure Security – AWS Config Rules
• Amazon CloudTrail is enabled…
• Is it?
• All EBS volumes are encrypted…
• Are they?
• All security groups in attached state should not have
unrestricted access to port 22.
• Do they?

30. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Infrastructure Security – AWS Config Rules
• Codify and Automate your own Practices
• Get started with Samples in AWS Lambda
• Implement guidelines for security best practices and
compliance
• Use Rules from various AWS Partners
• View Compliance in one Dashboard

31. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Infrastructure Security – AWS Config Rules
Undesirable Event Log Source Action (Remedial or
Alerting)
Function to Perform
• Set your Policy, formulate your implementation plan:

32. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Infrastructure Security – AWS Config Rules

33. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Infrastructure Security – AWS Config Rules

34. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Infrastructure Security – AWS Config Rules

35. Introducing AWS Organizations
Control AWS service
use across accounts
Policy-based management for multiple AWS accounts.
Consolidate billingAutomate AWS
account creation

36. Industry Best Practices for
Securing AWS Resources
CIS Amazon Web Services Foundations
Architecture agnostic set of security configuration
best practices
provides set-by-step implementation and
assessment procedures

37. Automating New Account Security Baselining…

38. AWS Enterprise Accelerator:
Compliance Architectures
Sample Architecture –
Security Controls Matrix
Cloudformation Templates
5 x templates
User Guide
http://docs.aws.amazon.com/quickstart/latest/accelerator-nist/welcome.html

39. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Infrastructure Security – Organizations SCPs
• Enables you to control which AWS service APIs are
accessible
- Define the list of APIs that are allowed – whitelisting
- Define the list of APIs that must be blocked – blacklisting
• Cannot be overridden by local administrator
• Resultant permission on IAM user/role is the intersection
between the SCP and assigned IAM permissions
• Necessary but not sufficient
• IAM policy simulator is SCP aware

40. {
"Version": "2012-10-17",
"Statement": [{
"Effect": "Allow",
"Action": "*",
"Resource": "*"
},
{
"Effect": "Deny",
"Action": "redshift:*",
"Resource": "*"
}
]
}
{
"Version": "2012-10-17",
"Statement": [{
"Effect": "Allow",
"Action": [
"ec2:RunInstances",
"ec2:DescribeInstances",
"ec2:DescribeImages",
"ec2:DescribeKeyPairs",
"ec2:DescribeVpcs",
"ec2:DescribeSubnets",
"ec2:DescribeSecurityGroups"
],
"Resource": "*"
}]}
Blacklisting example Whitelisting example

41. More on SCPs
But:
• you don't have to apply an SCP before you populate your account with
assets...
• this lends the idea of "immutable infrastructure" to other services, from
the point of view of the child accounts
• (including Serverless)
• eg:
• S3 websites which can't have their contents changed
• Lambda functions which are invoke-only "black boxes"
• ACM cert / key pairs which can't be deleted
• Prevent CloudTrail, Config ever being turned off
• ...

42. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Data Protection
AWS CloudHSM AWS Key Management Service
AWS Certificate Manager

43. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Data Protection - Encryption
Encryption In-Transit
SSL/TLS
VPN / IPSEC
SSH
Encryption At-Rest
Object
Database
Filesystem
Disk

44. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Data Protection – AWS KMS
Data key 1
S3 object EBS
volume
Amazon
Redshift
cluster
Data key 2 Data key 3 Data key 4
Custom
application
Customer Master Keys

45. Responding to Issues: the Automation Playbook…
CloudWatch
Events event
Adversary
(or Intern)
Your environment Responder

46. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Incident Response – AWS CloudWatch Events

47. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Incident Response – AWS CloudWatch Events

48. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Incident Response – AWS CloudWatch Events

49. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Incident Response – AWS CloudWatch Events

50. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Incident Response – AWS CloudWatch Events

51. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Incident Response – AWS CloudWatch Events

52. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Incident Response – Lambda Log
from __future__ import print_function
import json
def lambda_handler(event, context):
print(json.dumps(event, indent=2))

53. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Incident Response – AWS CloudWatch Events

54. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Incident Response – Lambda Respond
cloudtrail = boto3.client('cloudtrail')
trail_arn =
event["detail"]["requestParameters"]["name
"]
ct_response = cloudtrail.start_logging(
Name = trail_arn
)

55. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Incident Response – Lambda Notify
sns_topic = "arn:aws:sns:us-east-1:123459227412:reporter-topic"
subject = 'EVENT: ' + event["detail"]["eventName"]
message = "What happened? " + event["detail"]["eventName"] + "n"
"What service? " + event["detail"]["eventSource"] + "n"
"Where? " + event["detail"]["awsRegion"] + "n"
"When? " + event["detail"]["eventTime"] + "n"
"Who? " + str(json.dumps(event["detail"]["userIdentity"], indent=2))
sns = boto3.client('sns')
sns_response = sns.publish(
TopicArn = sns_topic,
Message = message,
Subject = subject,
MessageStructure = 'string'
)

56. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Incident Response – Amazon SNS Notification

57. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Incident Response – Complete

58. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Scaling to >1 Million Users
RDS DB Instance
Active (Multi-AZ)
Availability Zone
Load
balancer
RDS DB Instance
Read Replica
RDS DB Instance
Read Replica
Web
Instance
Web
Instance
Web
Instance
Web
Instance
Amazon
Route 53
User
Amazon S3
Amazon
CloudFront
DynamoDB
Amazon SQS
ElastiCache
Worker
Instance
Worker
Instance
Amazon
CloudWatch
Internal App
Instance
Internal App
Instance Amazon SES
Lambda

59. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Scaling to >1 Million Users
RDS DB Instance
Active (Multi-AZ)
Availability Zone
load balancer
RDS DB Instance
Read Replica
RDS DB Instance
Read Replica
Web
Instance
Web
Instance
Web
Instance
Web
Instance
Amazon
Route 53
User
Amazon S3
Amazon
CloudFront
DynamoDB
Amazon SQS
ElastiCache
Worker
Instance
Worker
Instance
Amazon
CloudWatch
Internal App
Instance
Internal App
Instance Amazon SES
Lambda
AWS
WAF
AWS
Shield
AWS
Organizations
AWS
CloudTrail
AWS
Config
VPC Flow Logs
Amazon
Inspector
AWS
OpsWorks

60. Security + DevOps = DevSecOps
DevOps = Efficiencies that speed up this lifecycle
DevSecOps = Validate building blocks without slowing lifecycle
developers customers
releasetestbuild
plan monitor
delivery pipeline
feedback loop
Software development lifecycle
Security

61. CI/CD for DevOps
Version
Control
CI Server
Package
Builder
Deploy Server
Commit to
Git/masterDev
Get /
Pull
Code
AMIs
Send Build Report to Dev
Stop everything if build failed
Distributed Builds
Run Tests in parallel
Staging Env
Test Env
Code
Config
Tests
Prod Env
Push
Config
Install
Create
Repo
CloudFormation
Templates for Environment
Generate

62. Version
Control
CI Server
Package
Builder
Promote
Process
Validate
Dev
Get /
Pull
Code
AMIs
Log for audit
Staging Env
Test Env
Code
Config
Tests
Prod Env
Audit/Validate
Config
Checksum
Continuous
Scan
CI/CD for DevSecOps
Send Build Report to Security
Stop everything if audit/validation failed
CloudFormation
Templates for Environment

63. Deployment Mechanisms for Software Artifacts
Amazon Machine
Images (AMIs)
Docker Image
OS Packages
Amazon EC2 Container
Service
AWS CloudFormation
AWS CodeDeploy

64. Amazon Machine
Images (AMIs)
Docker Images
OS Packages
Amazon EC2 Container
Service
AWS CloudFormation
AWS CodeDeploy
Software Artifacts Deployment Services
Deployment Mechanisms for Software Artifacts

65. Configuration building blocks
CloudFormation
Template
Task Definition Application
Specification File
(AppSpec file)
…and more.

66. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
AWS Marketplace Security Partners
Infrastructure
Security
Logging &
Monitoring
Identity & Access
Control
Configuration &
Vulnerability Analysis
Data Protection

67. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Summary
• AWS security benefits:
• Integrated security & compliance
• Global resilience, visibility, & control
• Maintain your privacy and data ownership
• Agility through security automation
• Security innovation at scale
• Broad security partner & marketplace solutions

68. Helpful Resources
Compliance Enablers: https://aws.amazon.com/compliance/compliance-enablers/
Risk & Compliance Whitepaper: https://aws.amazon.com/whitepapers/overview-of-risk-and-
compliance/
Compliance Centre Website: https://aws.amazon.com/compliance
Security Centre: https://aws.amazon.com/security
Security Blog: https://blogs.aws.amazon.com/security/
Well-Architected Framework: https://aws.amazon.com/blogs/aws/are-you-well-architected/
AWS Audit Training: awsaudittraining@amazon.com

69. New Security and Compliance Webinar Series
Getting Started with AWS Security: https://www.brighttalk.com/webcast/9019/256391
AWS Security Checklist: https://www.brighttalk.com/webcast/9019/257297
Automating Security Event Response: https://www.brighttalk.com/webcast/9019/258547
Compliance with AWS – Verifying AWS Security:: https://www.brighttalk.com/webcast/9019/260695
Securing Enterprise Big Data Workloads:
https://www.brighttalk.com/webcast/9019/261911
Architecting Security across Multi-Acct Architectures: https://www.brighttalk.com/webcast/9019/261915
AWS Security Best Practices: https://www.brighttalk.com/webcast/9019/264011
Software Security and Best Practices: https://www.brighttalk.com/webcast/9019/264917

70. Thank you!

71. © 2015, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Timothy Stranex, CTO @ Luno
2017-07-05
Security at Scale - Luno

72. Luno
• Bitcoin for everyone, everywhere
• Engineering team in Cape Town
• Offices in London, Cape Town and Singapore
• Customers in Europe, Africa and South-East Asia
• https://www.luno.com

73. Luno Products
Luno Wallet Luno Exchange Luno API

74. Introduction to Bitcoin
• Decentralised digital currency based on cryptography
• Uses a “blockchain” to record transactions on a decentralized ledger
• Uses public-key cryptography to authorise transactions
• Critically: The private key is required to sign transactions. If an attacker accesses a
private key, they can steal the funds attached to it.

75. Challenges
Many Bitcoin companies have been hacked in the past:
• MtGox 2014 $7M stolen
• Bitstamp 2015 $5M stolen
• Bitfinex 2016 $70M stolen
Security is a massive existential priority.
Luno has never been hacked (but not for lack of trying).

76. How to store Bitcoin securely
When you’re securing something as critical as Bitcoin, you can’t trust anyone.
• Key splitting: Require multiple counterparties to sign transactions
• Airgaps: Store keys on computers without internet access
• Physical vaults: Store private keys split between multiple bank vaults and countries
• Multiple people: Design systems so that multiple people are always required to
access keys and approve transactions
• Redundant layers: Have redundant layers so that any attacks on one layer are still
blocked at other layers

77. Security using AWS
• Virtual Private Cloud (VPC): Isolated network, use VPN to access
• Security Groups: Setup fine-grained firewall rules to whitelist network access
between instances
• Identity Access Management (IAM): Fine-grained control over access permissions
for users and API keys
• Elastic Load Balancer (ELB), Cloudfront: Mitigate DDOS by scaling
• AWS Certificate Manager (ACM): Issue SSL certificates for ELBs quickly and easily
• Cloudtrail Logs: Centralized log aggregation

78. Luno architecture
• Microservice architecture
• Docker containers running on
EC2 instances
• Backends are all written in Go
• MySQL instances on RDS
• Cape Town engineering team
Bitcoin
Banks
Load Balancers
(ELB)
VPN
MySQL
(RDS)
Redis
(ElastiCache)
Storage
(S3)
Frontends
(EC2/Docker/Go)
Backends
(EC2/Docker/Go)
Monitoring
(Cloudwatch+Prometheus)
GRPC
VPC

79. Impact of AWS
Implementing the necessary security procedures by leveraging AWS services like security
groups, VPC and IAM is 10x faster than building from scratch.
We’ve passed multiple security audits (Sensepost, Deloitte, MWR, etc) and withstood
many attacks without any successful theft of Bitcoin.
In addition to security, AWS made it easy to scale up as our customer base has grown
globally using services like RDS, ElastiCache, CloudFront and ELB.

80. Luno engineering
Join our talented team to scale systems and security in this fast-growing industry
https://www.luno.com/careers

82. Bitcoin
Banks
Load Balancers
(ELB)
VPN
MySQL
(RDS)
Redis
(ElastiCache)
Storage
(S3)
Frontends
(EC2/Docker/Go)
Backends
(EC2/Docker/Go)
Monitoring
(EC2/Prometheus)
GRPC