Learn how to increase the effectiveness of your security operations as you move to the cloud. This session for architects and IT administrators covers considerations for optimizing your incident response, monitoring, and audit response tactics to take advantage of built-in capabilities in AWS. This session provides practical advice you can apply today, pulled from industry research, direct experience helping customers migrate to the cloud, and from the speaker's own hard-earned lessons. Sponsored by Trend Micro.

2. @marknca

3. Strategy
Tactics

4. Traditional Responsibility Model
You

5. AWS
You
Shared Responsibility Model

6. AWS
Facilities
Physical
Network
Virtualization Layer
You
Shared Responsibility Model

7. Monitoring
Forensics
4 pillars of practice

11. SANS incident response process

12. SANS incident response process

13. Business point of view

14. Incident response before
Server
Analyze
Repair
Improve
Replacement

15. Incident response before
Instance
Analyze
Repair
Improve
Replacement

16. Advantages

17. In action…

19. Optimized response

20. Optimized response
Instance
Script
Analyze
Improve
API
Replacement

24. Business point of view

25. Creating an audit trail before
Servers
ChangeRecord
Storage
Logs
Firewall / IPS

26. Creating an audit trail before
Instances
ChangeRecord
CentralManagement
Logs
AWS Services

28. In action…

36. Please give us your feedback on this session.
Complete session evaluations and earn re:Invent swag.
http://bit.ly/awsevals