AWS Innovate 2020 - Cómo mejorar su resiliencia en seguridad con automatización en AWS - Dario Goldfarb
•Descargar como PPTX, PDF•
0 recomendaciones•70 vistas
AWS Innovate 2020 - Cómo mejorar su resiliencia en seguridad con automatización en AWS - Dario Goldfarb
Recomendados
Recomendados
Más contenido relacionado
Similar a AWS Innovate 2020 - Cómo mejorar su resiliencia en seguridad con automatización en AWS - Dario Goldfarb
Similar a AWS Innovate 2020 - Cómo mejorar su resiliencia en seguridad con automatización en AWS - Dario Goldfarb (20)
Más de Amazon Web Services LATAM
Más de Amazon Web Services LATAM (20)
Último
Último (16)
AWS Innovate 2020 - Cómo mejorar su resiliencia en seguridad con automatización en AWS - Dario Goldfarb
- 2. © 2020, Amazon Web Services, Inc. or its affiliates. All rights reserved. Cómo mejorar su resiliencia en seguridad con automatización enAWS Dario Goldfarb Security Solutions Architect Amazon Web Services
- 3. © 2020, Amazon Web Services, Inc. or its affiliates. All rights reserved. Agenda • Democratización de la seguridad • Diez áreas donde tu equipo de seguridad debe invertir tiempo • Respuesta a incidentes usando AWS Security Hub • Remediación automática con AWS Config • Automatización de incidentes detectados por GuardDuty • Protección de aplicaciones web
- 4. © 2020, Amazon Web Services, Inc. or its affiliates. All rights reserved. Democratización de la seguridad
- 5. © 2020, Amazon Web Services, Inc. or its affiliates. All rights reserved. COMERCIOBANCAGOBIERNO MEDIOS SALUD La escalade lanube es elvalor
- 6. © 2020, Amazon Web Services, Inc. or its affiliates. All rights reserved. La escalade lanube es elvalor Sāo Paulo GovCloud (US-West) Montréal N. Virginia GovCloud (US- East) Ireland London Paris Stockholm Bahrain Cape Town Mumbai Ningxia Beijing Singapore Hong Kong Seoul Tokyo Sydney Frankfurt Oregon N. California Milan Ohio Regiones Anunciadas Jakarta Spain Regiones Activas
- 7. © 2020, Amazon Web Services, Inc. or its affiliates. All rights reserved. Diez áreasdonde tu equipo de seguridad debe invertir tiempo
- 8. © 2020, Amazon Web Services, Inc. or its affiliates. All rights reserved. Diez áreasdonde tu equipo de seguridad debe invertir tiempo
- 9. © 2020, Amazon Web Services, Inc. or its affiliates. All rights reserved. Diez áreasdonde tu equipo de seguridad debe invertir tiempo
- 10. © 2020, Amazon Web Services, Inc. or its affiliates. All rights reserved. Diez áreasdonde tu equipo de seguridad debe invertir tiempo
- 11. © 2020, Amazon Web Services, Inc. or its affiliates. All rights reserved. Diez áreasdonde tu equipo de seguridad debe invertir tiempo
- 12. © 2020, Amazon Web Services, Inc. or its affiliates. All rights reserved. Diez áreasdonde tu equipo de seguridad debe invertir tiempo
- 13. © 2020, Amazon Web Services, Inc. or its affiliates. All rights reserved. Diez áreasdonde tu equipo de seguridad debe invertir tiempo
- 14. © 2020, Amazon Web Services, Inc. or its affiliates. All rights reserved. Diez áreasdonde tu equipo de seguridad debe invertir tiempo
- 15. © 2020, Amazon Web Services, Inc. or its affiliates. All rights reserved. Diez áreasdonde tu equipo de seguridad debe invertir tiempo
- 16. © 2020, Amazon Web Services, Inc. or its affiliates. All rights reserved. Diez áreasdonde tu equipo de seguridad debe invertir tiempo
- 17. © 2020, Amazon Web Services, Inc. or its affiliates. All rights reserved. Reduccióndeltiempoderespuestaconautomatización Tiempo Análisis Validación Remediación Evento Rule matched Alert sent Correlate Check baseline Remediate Incidentedetectado Tradicional Localización Logs Correlación Respuesta Respuesta Amazon CloudWatch CloudWatch Event Lambda Function AWS Step Function Amazon GuardDuty
- 18. © 2020, Amazon Web Services, Inc. or its affiliates. All rights reserved. Las cinco primeras cosas aautomatizar Tickets Políticas de IAM Registros de auditoría Detección de amenazas Alertas
- 19. © 2020, Amazon Web Services, Inc. or its affiliates. All rights reserved.
- 20. © 2020, Amazon Web Services, Inc. or its affiliates. All rights reserved. VisiónGeneral deAWSSecurity Hub
- 21. © 2020, Amazon Web Services, Inc. or its affiliates. All rights reserved. Funcionamiento de IAMAccessAnalyzer
- 22. © 2020, Amazon Web Services, Inc. or its affiliates. All rights reserved. Flujo derespuestaaincidentes usandoSecurityHub Security Hub CloudWatch Events Amazon GuardDuty Amazon Inspector Amazon Macie Third-party providers IAM Access Analyzer
- 23. © 2020, Amazon Web Services, Inc. or its affiliates. All rights reserved. Crearun analizador de IAMAccessAnalyzer
- 24. © 2020, Amazon Web Services, Inc. or its affiliates. All rights reserved. Crearun documento deautomatización conSSM
- 25. © 2020, Amazon Web Services, Inc. or its affiliates. All rights reserved. Crearuna acción personalizada enAWSSecurity Hub
- 26. © 2020, Amazon Web Services, Inc. or its affiliates. All rights reserved. Crearuna regla deAmazonCloudWatchEvents
- 27. © 2020, Amazon Web Services, Inc. or its affiliates. All rights reserved. Partiendo de unS3 bucket abierto alaccesopúblico
- 28. © 2020, Amazon Web Services, Inc. or its affiliates. All rights reserved. Sin una políticade recurso (sinbucket policy)
- 29. © 2020, Amazon Web Services, Inc. or its affiliates. All rights reserved. Creamos una políticadeaccesopúblico para lectura
- 30. © 2020, Amazon Web Services, Inc. or its affiliates. All rights reserved. Descubrimiento generado por elIAMAccessAnalyzer
- 31. © 2020, Amazon Web Services, Inc. or its affiliates. All rights reserved. Seseleccionalareglaysedisparaunaacciónpersonalizada
- 32. © 2020, Amazon Web Services, Inc. or its affiliates. All rights reserved. Bucket cerrado – políticade bucket sobreseída
- 33. © 2020, Amazon Web Services, Inc. or its affiliates. All rights reserved.
- 34. © 2020, Amazon Web Services, Inc. or its affiliates. All rights reserved. AWSConfig Cambio en recursos AWS Config Normalizado AWS Config rules Alertas Corregir la config. o revertir el cambio (vía SSM) Caso de Uso: mantener todos los buckets configurados para cifrar por defecto
- 35. © 2020, Amazon Web Services, Inc. or its affiliates. All rights reserved. Crearpolíticaque puede gestionar encripción deS3
- 36. © 2020, Amazon Web Services, Inc. or its affiliates. All rights reserved. Rol con permisos para ejecutar elcambio
- 37. © 2020, Amazon Web Services, Inc. or its affiliates. All rights reserved. Habilitarlareglaparaelcontroldeserversideencryption
- 38. © 2020, Amazon Web Services, Inc. or its affiliates. All rights reserved. RegladeAWSConfig El control se hace continuo, ante cambios en la configuración de Amazon S3 Ejecutamos la acción de remediación predefinida AWS-EnableS3BucketEncryption Que corrija automáticamente
- 39. © 2020, Amazon Web Services, Inc. or its affiliates. All rights reserved. RegladeAWSConfig Enviamos el nombre del bucket que encontró no conforme como parámetro a la acción de correción También definimos fijo el rol que debe asumir para tener la capacidad de cambiar la configuración de encripción de los buckets. Y establezco la encripción a usar
- 40. © 2020, Amazon Web Services, Inc. or its affiliates. All rights reserved. Resultado AWS Config
- 41. © 2020, Amazon Web Services, Inc. or its affiliates. All rights reserved.
- 42. © 2020, Amazon Web Services, Inc. or its affiliates. All rights reserved. AmazonGuardDuty – detección de amenazas • Detección de Anomalías con AI/ML • Fuentes de Inteligencia Amazon GuardDuty VPC flow logs DNS Logs CloudTrail Events HallazgosFuentes de Datos Nube AWS Amazon CloudWatch Events • Reconocimiento • Compromiso de Instancia / Cuenta • Compromiso de Cuenta • Minería de Criptomonedas RespuestaDetección AWS Lambda • Acción de respuesta • Ej. 1: Aislar una instancia reemplazando Security Groups. • Ej. 2 : Eliminar la instancia comprometida y que el Auto Scaling Group regenere la instancia
- 43. © 2020, Amazon Web Services, Inc. or its affiliates. All rights reserved. AmazonCloudWatchRule
- 44. © 2020, Amazon Web Services, Inc. or its affiliates. All rights reserved. AWS Lambda, configurado pararecibir alertasde AmazonCloudwatchEvents
- 45. © 2020, Amazon Web Services, Inc. or its affiliates. All rights reserved. Código quequitaSecurityGroups actualesylos reemplaza por el del equipo de respuestaaincidentes
- 46. © 2020, Amazon Web Services, Inc. or its affiliates. All rights reserved. SecurityGroup quesolo permiteacceso alequipo de respuesta a incidentes
- 47. © 2020, Amazon Web Services, Inc. or its affiliates. All rights reserved. Hallazgos enGuardDuty
- 48. © 2020, Amazon Web Services, Inc. or its affiliates. All rights reserved. Amenaza contenida
- 49. © 2020, Amazon Web Services, Inc. or its affiliates. All rights reserved. Planes de respuestamás complejos Step Functions workflow Auto Scaling group Instance GuardDuty Snapshot Virtual Desktop de Investigación Forense (hardened) Instance Security group B Envío Notificación (e-mail/SIEM) Snapshot Agrego Etiqueta → IAM prohíbe el acceso a la VM a todos excepto al equipo de respuesta a incidentes por su etiqueta Virtual desktop para Forense accede a instancias afectadas Modifico Security Group Se remueve la instancia del Auto Scaling Group (y se repone)CloudWatch Events
- 50. © 2020, Amazon Web Services, Inc. or its affiliates. All rights reserved.
- 51. © 2020, Amazon Web Services, Inc. or its affiliates. All rights reserved. Protección desus aplicaciones conAWSWAF HTTP floods Escaners y pruebas Inyecciones SQLBots y scrapers Listas de reputación IP Cross-site scripting
- 52. © 2020, Amazon Web Services, Inc. or its affiliates. All rights reserved. AWSWAF con reglas gestionadas https://aws.amazon.com/blogs/aws/announcing-aws-managed-rules-for-aws-waf/ Reglas provistas por socios+ YA DISPONIBLE
- 53. © 2020, Amazon Web Services, Inc. or its affiliates. All rights reserved. ProtecciónDDoSconAWSShield Disponible para todos los clientes de AWS sin costo adicional • Protección contra los ataques mas comunes (SYN/UDP Floods, Reflection Attacks, etc. Capa 3/4) • Detección y mitigación automática Estándar Avanzado Servicio pago que provee protección adicional contra ataques sofisticados ✚ Protección contra ataques avanzados (Capa 7) ✚ Equipo de respuesta DDoS 24x7 ✚ Protección de costos ✚ Mejor Monitoreo / Visualización
- 54. © 2020, Amazon Web Services, Inc. or its affiliates. All rights reserved. TrustedAdvisor –AsesorVirtual Valida la configuración de seguridad en su entorno, como: • Security Groups abiertos. • CloudTrail habilitado. • Permisos de Buckets S3 • Uso de MFA. • Política de contraseñas. • DB con riesgos de acceso. • Registros DNS.
- 55. Gracias ! © 2020, Amazon Web Services, Inc. or its affiliates. All rights reserved. Dario Goldfarb Security Solutions Architect Amazon Web Services
Notas del editor
- So it’s going to be a brisk 55 minutes here, a little something for everyone. Now then, what do I mean when I talk about the democratization of security? Distilled way down, what we mean here is security for all, regardless of spend or resources. Everyone gets access to all the services and features that huge enterprises do. So where say an AWS, or a Netflix, or an Expedia, or an AirBnB are seeing an aggregate billions of use case every day, you’re getting that knowledge and expertise through a single click. When we learn something, you learn it too, by inference, and this is the massive advantage of scale. This is where democratization comes in, the word democracy is of greek in origin and it literally means “rule by people”. In our case at AWS, the people, the customers, get access and insight and “votes”, if you will, into all the output. You get the same rights, freedoms, and advantages as any other “citizen of AWS”. And that’s a very powerful advantage for any business to possess.
- As we start to talk about the advantages you’re conveyed as an AWS customer, it’s important to note the vast amount of use cases we see. We hear from customers across the world, in every vertical. Every time a customer makes a request for a feature, that gets in product feature request. Every time there is a new trend in h
- You’ve likely seen this slide before, but it keeps growing, so I always try to feature it. Wherever you’re at in the world, we want to meet you more than halfway. We don’t set up a building, or a region, in a place and call it good. We want max robustness. Our infrastructure spans 69 Availability Zones within 22 geographic regions around the world. We’ve also announced plans for 13 more Availability Zones, and 4 more AWS Regions in Cape Town, Jakarta, Spain and Milan. We have over 2.6M miles of network.
- As we talk about security scale and security basics, I want to draw your attention to this slide. I know re:Invent attendees love to take pictures and tweet out advice, please take a moment and send this out into the universe! If half a dozen people see this slide and think, “Huh, I don’t know if we’ve done all this” and they then take action, I can feel like we did something valuable together today. This is a conflict of inches. The little things add up to big things. So let’s dive a little deeper into these concepts now.
- As we talk about security scale and security basics, I want to draw your attention to this slide. I know re:Invent attendees love to take pictures and tweet out advice, please take a moment and send this out into the universe! If half a dozen people see this slide and think, “Huh, I don’t know if we’ve done all this” and they then take action, I can feel like we did something valuable together today. This is a conflict of inches. The little things add up to big things. So let’s dive a little deeper into these concepts now.
- As we talk about security scale and security basics, I want to draw your attention to this slide. I know re:Invent attendees love to take pictures and tweet out advice, please take a moment and send this out into the universe! If half a dozen people see this slide and think, “Huh, I don’t know if we’ve done all this” and they then take action, I can feel like we did something valuable together today. This is a conflict of inches. The little things add up to big things. So let’s dive a little deeper into these concepts now.
- As we talk about security scale and security basics, I want to draw your attention to this slide. I know re:Invent attendees love to take pictures and tweet out advice, please take a moment and send this out into the universe! If half a dozen people see this slide and think, “Huh, I don’t know if we’ve done all this” and they then take action, I can feel like we did something valuable together today. This is a conflict of inches. The little things add up to big things. So let’s dive a little deeper into these concepts now.
- As we talk about security scale and security basics, I want to draw your attention to this slide. I know re:Invent attendees love to take pictures and tweet out advice, please take a moment and send this out into the universe! If half a dozen people see this slide and think, “Huh, I don’t know if we’ve done all this” and they then take action, I can feel like we did something valuable together today. This is a conflict of inches. The little things add up to big things. So let’s dive a little deeper into these concepts now.
- As we talk about security scale and security basics, I want to draw your attention to this slide. I know re:Invent attendees love to take pictures and tweet out advice, please take a moment and send this out into the universe! If half a dozen people see this slide and think, “Huh, I don’t know if we’ve done all this” and they then take action, I can feel like we did something valuable together today. This is a conflict of inches. The little things add up to big things. So let’s dive a little deeper into these concepts now.
- As we talk about security scale and security basics, I want to draw your attention to this slide. I know re:Invent attendees love to take pictures and tweet out advice, please take a moment and send this out into the universe! If half a dozen people see this slide and think, “Huh, I don’t know if we’ve done all this” and they then take action, I can feel like we did something valuable together today. This is a conflict of inches. The little things add up to big things. So let’s dive a little deeper into these concepts now.
- As we talk about security scale and security basics, I want to draw your attention to this slide. I know re:Invent attendees love to take pictures and tweet out advice, please take a moment and send this out into the universe! If half a dozen people see this slide and think, “Huh, I don’t know if we’ve done all this” and they then take action, I can feel like we did something valuable together today. This is a conflict of inches. The little things add up to big things. So let’s dive a little deeper into these concepts now.
- As we talk about security scale and security basics, I want to draw your attention to this slide. I know re:Invent attendees love to take pictures and tweet out advice, please take a moment and send this out into the universe! If half a dozen people see this slide and think, “Huh, I don’t know if we’ve done all this” and they then take action, I can feel like we did something valuable together today. This is a conflict of inches. The little things add up to big things. So let’s dive a little deeper into these concepts now.
- As we talk about security scale and security basics, I want to draw your attention to this slide. I know re:Invent attendees love to take pictures and tweet out advice, please take a moment and send this out into the universe! If half a dozen people see this slide and think, “Huh, I don’t know if we’ve done all this” and they then take action, I can feel like we did something valuable together today. This is a conflict of inches. The little things add up to big things. So let’s dive a little deeper into these concepts now.
- Reduz o tempo de resposta Melhor consistencia
- Tickets: Foco no en crearlos sino en resolverlos 96.4 % de los tickets de seguridad se resuelven automaticamente. Which leads us to automation. Automation, at this point, is a basic thing you should get as a value proposition of the cloud. All of the things on-screen are now easily automated with AWS tooling. Ticketing (as in support tickets) with Lambda. IAM Policies (Identity and Access Management) – Permissions based on roles rather than users. Logging w/ CloudTrail Threat detection GuardDuty Alerting w/ CloudWatch Alarms. And note, there are many ways within our services to get at these automation techniques.
- Default Deny Access Secured by default
- Hay otras armadas para restringir SSH abierto, y rehabilitar cloudtrail
- Al equipo de Incident Forensics
- en 5’ de tiempo de ejecución