Automating DDoS and WAF Response

1. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Dr. Andrew Kane
Solutions Architect, Amazon Web Services
Automating DDoS and WAF Response

2. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
AWS Shield ArchitectingTypes of Threats AWS WAF AWS Firewall
Manager

3. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
AWS Shield ArchitectingTypes of Threats AWS WAF AWS Firewall
Manager

4. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Types of threat
Bad BotsDDoS Application Attacks
UDP floods
SYN floods
Slowloris
SSL abuse
HTTP floods
UDP reflection
Content scrapers
Scanners & probes
CrawlersApplication
Layer
Network/
Transport
Layer
SQL injection
Application exploits

5. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
DDoS threats
Network / Transport Layer DDoS

6. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
On-Premises mitigation approach
• Scale network and fixed
infrastructure to mitigate DDoS
and WAF attacks on-site
• Visibility and control
• Large capital expenditures,
maintenance costs, and in-house
expertise

7. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Cloud-Routed mitigation approach
• Route traffic to other networks for
better mitigation capacity,
managed services
• Mitigate larger attacks without
upfront investment or in-house
expertise
• Black box solution – can introduce
latency, additional points of failure,
increased operating costs

8. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Cloud-Native mitigation approach
• Automatic, always-on DDoS and WAF
protection for all applications on AWS
• Leverage 18 AWS Geographic Regions, 1 Local
Region, 105 Edge Locations and 11 Regional
Caches to mitigate large attacks close to the
source
• Simple, flexible, and affordable, with visibility
into attacks and their remediations

9. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
“But why do I have to?”
CostScale Reliability/
Repeatability

10. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Response time comparison (example)
Time
Get logs
Analyze
Correlate
Trace origin
Locate
Remediate
Event delivered
Rule matched
Alert sent
Correlate
Check baseline
Remediate
Incidentdetected
Traditional
Response
Response

11. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Wrangling security information sources
CloudWatch
Events
On-Instance
Logs
VPC Flow
Logs
CloudWatch
Logs
CloudWatch
Alarms
Lambda Function
Amazon S3 Access Logs S3 Bucket
Macie GuardDutyCloudTrail
Shield
Advanced
WAF

12. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
AWS Shield ArchitectingTypes of Threats AWS WAF AWS Firewall
Manager

13. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
AWS Shield and Shield Advanced
Available to ALL AWS customers at no
additional cost
Standard Protection Advanced Protection
Paid service that provides additional
protections, features, and benefits

14. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
AWS Shield
• Automatic defense against the most
common network and transport layer
DDoS attacks for any AWS resource, in
any AWS Region
• Comprehensive defense against all
known network and transport layer
attacks when using Amazon CloudFront
and Amazon Route 53
• Application layer defense available when
using AWS WAF
Standard Protection
Automatically provided to all AWS
customers at no additional cost

15. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
AWS Shield Advanced
• Attack visibility and enhanced detection
• Cost Protection to mitigate economic
attack vectors
• AWS WAF for application-layer defense,
at no additional cost
• Fast escalation to the AWS DDoS
Response Team (DRT) to assist with
complex edge cases
Advanced Protection
Available globally on Amazon
CloudFront, Amazon Route 53, and in
select AWS Regions

16. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Effective Against:
• HTTP Floods
• Bad Bots
• Suspicious IPs
Effective Against:
• SSL Attacks
• Slowloris
• Malformed HTTP
Effective Against:
• SYN Floods
• Reflection Attacks
• Suspicious
Sources
Defence in depth
Border Network
Network Layer Mitigations
AWS Services
Web Layer Mitigations
Customer Infrastructure
DDoS
Detection
Internet
Internet-
Layer
Mitigations
DDoS
Effective Against:
• Large-scale
attacks
Effective Against:
• Sophisticated
Layer 7 attacks
DDoS
Response
Team

17. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
DEMO: SHIELD ADVANCED
• Monitoring and Alerting Setup
• UDP Flood Attack Mitigation

18. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
AWS Shield ArchitectingTypes of Threats AWS WAF AWS Firewall
Manager

19. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
UDP floods
SYN floods
Slowloris
SSL abuse
UDP reflection
HTTP floods
Types of threat
Bad BotsDDoS Application Attacks
Content scrapers
Scanners & probes
CrawlersApplication
Layer
Network/
Transport
Layer
SQL injection
Application exploits
AWSWAF

20. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Application threats and Bad bots
Good users
and bots
Bad guys
Web server
Database
SQL injection
Application
exploits
Bad bots
Content scrapers
Scanners & probes
Crawlers

21. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
What is AWS WAF
Web traffic filtering
with custom rules
Malicious request
blocking
Active monitoring
and tuning

22. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
AWS WAF
Fast Incident
Response
Managed
Rulesets
APIs for
Automation
Flexible Rule
Language
“A web application firewall designed to help you
defend against common web application exploits.”

23. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
AWS Marketplace rule groups
• Pre-defined rules written by AWS or
AWS Partners
• Designed for different purposes, e.g.
• Specific applications, such as WordPress
• OWASP Top 10 vulnerabilities
• Automatically updated as threats
emerge
• No long-term contracts

24. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
DEMO: WAF VIRTUAL PATCHING
• Write and roll-out patch for Struts
CVE-2017-5638

25. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
AWS Shield ArchitectingTypes of Threats AWS WAF AWS Firewall
Manager

26. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Region .vs. Edge mitigation coverage
Layer 3
(UDP Reflection)
Reduce Attack
Surface
Scale-Out
To Absorb
Layer 4
(SYN Flood)
Layer 6
(SSL)
Sloloris
Amazon
Route 53
Auto-Scaling
EC2 Instances
Amazon
CloudFront
AWS WAF
Amazon
API Gateway
Amazon
VPC
Layer 7
(App)
Elastic Load
Balancer

27. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Region .vs. Edge mitigation coverage
Layer 3
(UDP Reflection)
Reduce Attack
Surface
Scale-Out
To Absorb
Layer 4
(SYN Flood)
Layer 6
(SSL)
Sloloris
Geographic
Isolation
Amazon
Route 53
Auto-Scaling
EC2 Instances
Amazon
CloudFront
AWS WAF
Amazon
API Gateway
Amazon
VPC
Layer 7
(App)
Elastic Load
Balancer

28. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
DDoS-resilient architecture
Amazon
Route 53
ALB Security Group
Amazon
EC2
Instances
Application
Load Balancer
Amazon
CloudFront
Public Subnet
Web Application
Security Group
Private Subnet
AWS WAF
Amazon
API Gateway
DDoS
Attack
Users
Globally distributed attack
mitigation capability
SYN proxy feature that verifies
three-way handshake before
passing to the application
Slowloris mitigation that reaps
long-lived collections
Mitigates complex attacks by
allowing only the most
reliable DNS queries
Validates DNS
Provides flexible rule
language to block or rate-limit
malicious requests

29. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
AWS Shield ArchitectingTypes of Threats AWS WAF AWS Firewall
Manager

30. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Managing WAF rules at scale
ALB Security Group
Application
Load Balancer
Public Subnet
AWS WAF
Central Corporate Rules
Application-Specific Rules
Compliance-Specific Rules
?

31. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
AWS Firewall Manager
• Automatic Enforcement – any AWS WAF
rule on any supported resource
• Resource Groups – group by Account, by
Resource Type or by Tag
• Multi-Account Support – integrated with
AWS Organizations
• Hierarchical Rules – locally-deployed rules
can be layered on top of central rules
• Compliance dashboard – quickly view which
resources are in or out of compliance
Available to Shield Advanced customers at no
additional cost
Available globally on Amazon
CloudFront and in selected
AWS Regions

32. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Service pre-requisites
AWS Organizations
Your organization must be using AWS
Organizations to manage accounts, and
All Features must be enabled.
Also, delegate one account to the be
Firewall Manager Administrator account
AWS Config
You must have AWS Config enabled for
all accounts in your AWS Organization in
order to allow AWS Firewall Manager to
detect resource changes

33. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
How to setup a managed rule
Security Policy
Policy Scope
Resource Selection
Tagging
New / All Resources
Rule Group
Managed Protection
-or-
WAF Rules
WAF Rule
10 Rules

34. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
DEMO: Firewall Manager
• Automated compliance of a new
AWS Organizations account

35. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
AWS Shield ArchitectingTypes of Threats AWS WAF AWS Firewall
Manager

36. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Closing thoughts
• Bots and scanners will not go away
• AWS Shield makes it easier to protect applications on AWS (or
elsewhere)
• AWS WAF is not a black box, provides better latency and throughput
• Greatly simplified incident response process
• What other operational processes can we automate?

37. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Thank you!
Please complete the session survey in
the summit mobile app.