Speaker: Andrew Kane, AWS Level: 300/400 Security professionals and full-stack engineers will learn how to defend against distributed denial of service (DDoS) attacks and web application exploits by using automation to monitor activity, configure rate limiting, and deploy network filtering rules. You will become an expert in advanced techniques to help you protect and monitor your AWS networks and resources using services such as AWS Web Application Firewall, AWS Shield, AWS CloudWatch, and more. You will also learn how to use Lambda functions to automate event response and integrate with your security operations tools.

1. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Dr. Andrew Kane
Solutions Architect, Amazon Web Services
David Beukes
CTO, DPO Paygate
Automating DDoS and WAF Response

2. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
AWS Shield ArchitectingTypes of Threats AWS WAF AWS Firewall
Manager
DEM
O
DEM
O

3. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
AWS Shield ArchitectingTypes of Threats AWS WAF AWS Firewall
Manager

4. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Types of threat
Bad BotsDDoS Application Attacks
UDP floods
SYN floods
Slowloris
SSL abuse
HTTP floods
UDP reflection
Content scrapers
Scanners & probes
CrawlersApplication
Layer
Network/
Transport
Layer
SQL injection
Application exploits

5. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Types of threat
Bad BotsDDoS Application Attacks
UDP floods
SYN floods
Slowloris
SSL abuse
HTTP floods
UDP reflection
Content scrapers
Scanners & probes
CrawlersApplication
Layer
Network/
Transport
Layer
SQL injection
Application exploits

6. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Types of threat
Bad BotsDDoS Application Attacks
UDP floods
SYN floods
Slowloris
SSL abuse
HTTP floods
UDP reflection
Content scrapers
Scanners & probes
CrawlersApplication
Layer
Network/
Transport
Layer
SQL injection
Application exploits

7. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
DDoS threats
Network / Transport Layer DDoS

8. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
On-Premises mitigation approach
• Scale network and fixed
infrastructure to mitigate DDoS
and WAF attacks on-site
• Visibility and control
• Large capital expenditures,
maintenance costs, and in-house
expertise

9. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Cloud-Routed mitigation approach
• Route traffic to other networks for
better mitigation capacity,
managed services
• Mitigate larger attacks without
upfront investment or in-house
expertise
• Black box solution – can introduce
latency, additional points of failure,
increased operating costs

10. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Cloud-Native mitigation approach
• Automatic, always-on DDoS and WAF
protection for all applications on AWS
• Leverage 18 AWS Geographic Regions, 1 Local
Region, 112 Edge Locations and 11 Regional
Caches to mitigate large attacks close to the
source
• Simple, flexible, and affordable, with visibility
into attacks and their remediations

11. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
“But why do I have to?”
CostScale Reliability/
Repeatability

12. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Wrangling security information sources
CloudWatch
Events
On-Instance
Logs
VPC Flow
Logs
CloudWatch
Logs
CloudWatch
Alarms
(via
Am
azon
SN
S)
Lambda Function
Amazon S3 Access Logs S3 Bucket
Macie GuardDutyCloudTrail
Shield
Advanced
WAF

13. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
A Quick Aside: Amazon CloudFront

14. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
• Global Content Delivery Network
• Integrated with AWS WAF and AWS Shield
• Intelligence of Lambda@Edge Compute Capability
• Built In Security Features
• Cost Effective Pricing Options
Amazon CloudFront – Highlights

15. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Amazon
Route 53
Amazon
CloudFront
AWS WAF
Amazon
API Gateway
Amazon CloudFront – Edge Locations
Global Network Infrastructure
123 PoPs (112 Edge, 11 Regional)
26 Countries, 59 Cities

16. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Custom Origin
Protection
Header and ACL
Content Protection
Signed URL /
Cookies
Content Restriction
Geo Blocking
S3 Origin Access
Identity
Access
Control
Amazon CloudFront – Built-in Security Controls
Offload Heavy-Lifting to the Edge

17. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
SSLv3
TLSv1.0
TLSv1.1
TLSv1.2
Advanced Ciphers
Certificate Manager
RSA and ECDSA
Algorithms
OCSP Stapling
Session Tickets
Perfect Forward
Secrecy
Protocol Enforcement
Half / Full Bridge
Connections
Encrypted
Connections
Custom Origin
Protection
Header and ACL
Content Protection
Signed URL /
Cookies
Content Restriction
Geo Blocking
S3 Origin Access
Identity
Access
Control
Compliance: PCI DSS Level 1, HIPAA, FedRamp, ISO 9001, 27001, 27017, 27018
Amazon CloudFront – Built-in Security Controls
Offload Heavy-Lifting to the Edge

18. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
AWS Shield ArchitectingTypes of Threats AWS WAF AWS Firewall
Manager

19. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
AWS Shield and Shield Advanced
Automatically provided to all AWS
customers at no additional cost
Standard Protection Advanced Protection
Paid service that provides additional
protections, features, and benefits

20. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
AWS Shield
• Automatic defense against the most
common network and transport layer
DDoS attacks for any AWS resource, in
any AWS Region
• Comprehensive defense against all
known network and transport layer
attacks when using Amazon CloudFront
and Amazon Route 53
• Application layer defense available when
using AWS WAF
Standard Protection
Automatically provided to all AWS
customers at no additional cost

21. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
AWS Shield Advanced
• Attack visibility and enhanced detection
• Cost Protection to mitigate economic
attack vectors
• AWS WAF for application-layer defense,
at no additional cost
• Fast escalation to the AWS DDoS
Response Team (DRT) to assist with
complex edge cases
Advanced Protection
Available globally on Amazon
CloudFront, Amazon Route 53, and in
select AWS Regions

22. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Defence in depth
Border Network
Network Layer Mitigations
AWS Services
Web Layer Mitigations
Customer Infrastructure
DDoS
Detection
Internet
Internet-
Layer
Mitigations
DDoS
Effective Against:
• Large-scale
attacks
DDoS
Response
Team

23. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Effective Against:
• SYN Floods
• Reflection Attacks
• Suspicious
Sources
Defence in depth
Border Network
Network Layer Mitigations
AWS Services
Web Layer Mitigations
Customer Infrastructure
DDoS
Detection
Internet
Internet-
Layer
Mitigations
DDoS
DDoS
Response
Team

24. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Effective Against:
• SSL Attacks
• Slowloris
• Malformed HTTP
Defence in depth
Border Network
Network Layer Mitigations
AWS Services
Web Layer Mitigations
Customer Infrastructure
DDoS
Detection
Internet
Internet-
Layer
Mitigations
DDoS
DDoS
Response
Team

25. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Effective Against:
• HTTP Floods
• Bad Bots
• Suspicious IPs
Defence in depth
Border Network
Network Layer Mitigations
AWS Services
Web Layer Mitigations
Customer Infrastructure
DDoS
Detection
Internet
Internet-
Layer
Mitigations
DDoS
DDoS
Response
Team

26. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Defence in depth
Border Network
Network Layer Mitigations
AWS Services
Web Layer Mitigations
Customer Infrastructure
DDoS
Detection
Internet
Internet-
Layer
Mitigations
DDoS
Effective Against:
• Sophisticated
Layer 7 attacks
DDoS
Response
Team

27. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
DEMO: SHIELD ADVANCED
• Monitoring and Alerting Setup
• UDP Flood Attack Mitigation

28. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
AWS Shield ArchitectingTypes of Threats AWS WAF AWS Firewall
Manager

29. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
UDP floods
SYN floods
Slowloris
SSL abuse
UDP reflection
HTTP floods
Types of threat
Bad BotsDDoS Application Attacks
Content scrapers
Scanners & probes
CrawlersApplication
Layer
Network/
Transport
Layer
SQL injection
Application exploits
AWSWAF

30. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Application threats and Bad bots
Good users
and bots
Bad guys
Web server
Database
SQL injection
Application
exploits
Bad bots
Content scrapers
Scanners & probes
Crawlers

31. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
AWS WAF
Fast Incident
Response
Managed
Rulesets
APIs for
Automation
Flexible Rule
Language
“A web application firewall designed to help you
defend against common web application exploits.”

32. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
AWS Marketplace rule groups
• Pre-defined rules written by AWS or
AWS Partners
• Designed for different purposes, e.g.
• Specific applications, such as WordPress
• OWASP Top 10 vulnerabilities
• Automatically updated as threats
emerge
• No long-term contracts

33. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
DEMO: WAF VIRTUAL PATCHING
• Write and roll-out patch for Struts
CVE-2017-5638

34. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
AWS Shield ArchitectingTypes of Threats AWS WAF AWS Firewall
Manager

35. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Our vision is to provide an accessible, reliable, secure
and comprehensive payments network across Africa.

36. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Territories
Botswana
Ethiopia
Ghana
Kenya
Malawi
Mauritius
Namibia
Nigeria
Rwanda
South Africa
Tanzania
Uganda
Zambia
Zimbabwe
Angola*
Cabo Verde*
Cameroon*
DRC*
Ivory Coast*
Lesotho*
Madagascar*
Mali*
Morocco*
Mozambique*
Réunion*
Senegal*
Swaziland*
Togo*
14 countries in 2017
28 countries in 2018

37. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Industries & Volumes
Online
Retail
Travel &
Tourism
2017:
200 transactions / minute
2018:
350 transactions / minute
Black Friday / Peak:
700 transactions / minute

38. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Payment Options

39. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Victim of a DDoS
• On premises data center
• PCI-DSS Level 1 compliant
• Proof of concept attack
• Threat of sustained attack
• Core business impact

40. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Amazon
Route 53
DDos mitigation with AWS
DC

41. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Amazon
Route 53
Amazon
CloudFront
DDos mitigation with AWS
DC

42. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Amazon
Route 53
Amazon
CloudFront
WAF
Shield
Advanced
DDOS DDoS Response
Team
DDos mitigation with AWS
DC

43. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Amazon
Route 53
Amazon
CloudFront
Amazon
EC2
Amazon
EC2
Amazon
EC2
Elastic Load
Balancer
WAF
Shield
Advanced
DDOS DDoS Response
Team
DDos mitigation with AWS
Auto Scaling
group
DC

44. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
The Aftermath
• No impact from subsequent attacks
• Increased visibility and improved monitoring
• Scale to absorb attack

45. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
It’s not a case
of if you get
targeted, but
when you get
targeted.

46. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Thank you!

47. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
AWS Shield ArchitectingTypes of Threats AWS WAF AWS Firewall
Manager

48. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Managing WAF rules at scale
ALB Security Group
Application
Load Balancer
Public Subnet
AWS WAF
Central Corporate Rules
Application-Specific Rules
Compliance-Specific Rules
?

49. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
AWS Firewall Manager
• Automatic Enforcement – any AWS WAF
rule on any supported resource
• Resource Groups – group by Account, by
Resource Type or by Tag
• Multi-Account Support – integrated with
AWS Organizations
• Hierarchical Rules – locally-deployed rules
can be layered on top of central rules
• Compliance dashboard – quickly view which
resources are in or out of compliance
Available to Shield Advanced customers at no
additional cost
Available globally on Amazon
CloudFront and in selected
AWS Regions

50. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Service pre-requisites
AWS Organizations
Your organization must be using AWS
Organizations to manage accounts, and
All Features must be enabled.
Also, delegate one account to the be
Firewall Manager Administrator account
AWS Config
You must have AWS Config enabled for
all accounts in your AWS Organization in
order to allow AWS Firewall Manager to
detect resource changes

51. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Managed rule compliance dashboard

52. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
AWS Shield ArchitectingTypes of Threats AWS WAF AWS Firewall
Manager

53. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Closing thoughts
• Bots and scanners will not go away
• AWS Shield makes it easier to protect applications on AWS (or
elsewhere)
• AWS WAF is not a black box, provides better latency and throughput
• Greatly simplified incident response process
• What other operational processes can we automate?

54. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
https://aws.amazon.com/aws-africa/
Thank you!