Build on AWS

1. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Bisham Kishnani
Head Consulting Engineering – APAC, Palo Alto Networks
Cloud Conversations:
Giving Business Transformation a Voice
Kenneth Sim
Director, Consulting Services, AsiaPac Distribution

2. DATA AND APPLICATIONS ARE ?
2 | © 2018, Palo Alto Networks. All Rights Reserved.

3. DATA AND APPLICATIONS ARE EVERYWHERE
SAASPRIVATE
PHYSICAL
IAAS PAAS
3 | © 2018, Palo Alto Networks. All Rights Reserved.

4. TODAY’S TOP PRIORITY FOR A CIO
4 | © 2018, Palo Alto Networks. All Rights Reserved.

5. 5 | © 2018, Palo Alto Networks. All Rights Reserved.

6. SECURITY CAN BE….
Fragmented Prone to
Human
Error
Manual
6 | © 2018, Palo Alto Networks. All Rights Reserved.

7. Cloud API has changed
the attack surface
1000s of ways to
misconfigure
Attacks are more
automated than security
Too long to validate
compliance
Managing multi-cloud
security is complex
Engineers can create
massive failures
Fragmented Manual Human Error
SECURITY CAN BE.…
7 | © 2018, Palo Alto Networks. All Rights Reserved.

8. WHAT’S NEEDED
Frictionless
Deployment &
Management
Advanced
Application & Data
Breach Prevention
Consistent
Protection across
Locations & Clouds
8 | © 2018, Palo Alto Networks. All Rights Reserved.

9. Partial &
Broader Context
=
Flawed Conclusion
Visibility
WHAT’S NEEDED
9 | © 2018, Palo Alto Networks. All Rights Reserved.

10. WHATS NEEDED
344 KB file-sharing
URL category
PowerPoint
file type
“Confidential and Proprietary”
content
mjacobsen
user
prodmgmt
group
canada
destination country
172.16.1.10
source IP
64.81.2.23
destination IP
TCP/443
destination port
SSL
protocol
HTTP
protocol
slideshare
application
slideshare-uploading
application function
10 | © 2018, Palo Alto Networks. All Rights Reserved.

11. Security in the Cloud
is built upon
Shared Responsibility
and a
Collaborative Approach
11 | © 2018, Palo Alto Networks. All Rights Reserved.

12. SEPARATION OF RESPONSIBILITES
12 | © 2018, Palo Alto Networks. All Rights Reserved.

13. SECURITY:
A SHARED RESPONSIBILITY
13 | © 2017, Palo Alto Networks. Confidential and Proprietary.
Cloud Infrastructure & Services
Compute Storage Database Networking
Encryption Key
Management
Client & Server
Encryption
Network Traffic
Protection
Platform, Applications, Identity & Access Management
Operating System, Network & Firewall Configuration
Customer content
Customers are
responsible for their
security IN the cloud
AWS looks after
security OF the
cloud

14. NEW
OVER FIVE YEARS OF CONTINUED INVESTMENTS
2013 2014 2015 2016 2017 2018
AWS CloudFormation
AWS ELB
AWS Auto-Scaling Config Drive AWS Lambda
Heat
Templates
Cloud Infrastructure Support
Orchestration and Automation
Integration
Advanced
Automation
14 | © 2018, Palo Alto Networks. All Rights Reserved.

15. CORE ELEMENTS OF PUBLIC CLOUD SECURITY
WEB APP
Web Server App Server
Protect and segment
cloud workloads
INLINE
CLOUD APPLICATION
1
Infrastructure-as-a-Service (IaaS)
15 | © 2018, Palo Alto Networks. All Rights Reserved.

16. CLOUD APPLICATION
Secure OS and app
within workloads
WEB APP
Web Server App Server
HOST
Protect and segment
cloud workloads
INLINE
1 2
Infrastructure-as-a-Service (IaaS)
CORE ELEMENTS OF PUBLIC CLOUD SECURITY
16 | © 2018, Palo Alto Networks. All Rights Reserved.

17. CLOUD APPLICATION
Secure OS and app
within workloads
Continuous security
& compliance
API
WEB APP
Web Server App Server
HOST
Protect and segment
cloud workloads
INLINE
1 2
3
Infrastructure-as-a-Service (IaaS)
OBJECT STORAGE CACHING DATABASE
Platform-as-a-Service (PaaS)
CORE ELEMENTS OF PUBLIC CLOUD SECURITY
17 | © 2018, Palo Alto Networks. All Rights Reserved.

18. CLOUD APPLICATION
Secure OS and app
within workloads
THE MOST COMPLETE OFFERING FOR THE PUBLIC CLOUD
Continuous security
& compliance
API
WEB APP
Web Server App Server
HOST
Protect and segment
cloud workloads
INLINE
Infrastructure-as-a-Service (IaaS)
OBJECT STORAGE CACHING DATABASE
Platform-as-a-Service (PaaS)
18 | © 2018, Palo Alto Networks. All Rights Reserved.

19. Protect and segment
cloud workloads
INLINE
1
19 | © 2018, Palo Alto Networks. All Rights Reserved.

20. VM-SERIES:
PROTECT & SEGMENT CLOUD WORKLOADS
CLOUD APPLICATION
WEB APP
Web
Server
App
Server
Infrastructure-as-a-Service (IaaS)
OBJECT STORAGE CACHING DATABASE
Platform-as-a-Service (PaaS)
Application visibility and
workload segmentation
Centrally manage and automate
deployments
Prevent outbound and
inbound attacks

21. VALUE WHICH WE GET ON CLOUD
Identify applications
Control traffic based on application, not only port
Prevent known and unknown threats
Grant access based on user identity
NGFW Visibility and Control
Automated Scale up and Scale out
Provisioning/Hybrid
Lambda, Elastic/Application Load Balancing, CloudWatch,
Cloud Templates, Application Insight Manager, ASC
MULTI-CLOUDCLOUD SCALE
ENTERPRISE CLASS
SECURITY
POLICY MANAGEMENT
CLOUD INTEGRATION

22. VALUE WHICH WE GET ON CLOUD
§ Manage traffic with a single line
§ Determine the matching criteria of traffic by using
§ Network Zones, IP Addresses
§ User ID or Groups
§ Machine State
§ Applications (Layer 7)
§ Ports / Services
§ Define Content Scanning Profiles
Anti-Spyware Profile
All traffic scanned
URL Filtering Profile
Filter Unwanted URL Categories
AV Profile
All filles scanned
IPS Profile
All Exploits Scanned
FileBlocking Profile
Control File attachments

23. PERIODIC TABLE
23
OF DEVOPS TOOLS

24. SECURITY & DEVOPS
DevOps Is Dynamic Security Is Static

25. SECURITY & DEVOPS

26. TOOLS TO AUTOMATE SECURITY IN THE CLOUD
Fully documented XML API
XML API
Dynamic Policy Updates
External Dynamic Lists
HTTP Log Forwarding
• Quarantine
• Service ticketing
• Other…
HTTP logsBootstrapping

27. AWS
CloudFormation
AWS
Lambda
Automation Tools
FRICTIONLESS SECURE CLOUD OPERATIONS
Template-based
deployment
Build
Bootstrapped
Configuration
Embed Agent
into Workloads
Operate
Segment Based on
Apps & Attributes
Orchestrate Policy
via XML API
Continuously
Monitor Resources
& Storage
Scale
Auto-scale Based
on Triggers
Policies Updated
Automatically
Integration into
Native Services

29. AWS MARKET PLACE

31. CLOUD RESIDENT MANAGEMENT WITH PANORAMA
Security
management and
logging for any cloud
NEW

32. PANORAMA AND LOGGING AS A SERVICE
32 | © 2018, Palo Alto Networks. Confidential and Proprietary.
Logging
Policies
Cloud-based deployment
enables scalability and agility
Reduces the operational
burden associated with log
collection
Opt-in contribution to
Application Framework
Manage all physical and
virtualized appliances,
regardless of environment
Reporting & Analysis
Logging Service
Panorama
Logging Service

33. 33 | © 2018, Palo Alto Networks. Confidential and Proprietary.

34. Deployment Use Cases
Protect your AWS deployment just as you would in your data center
Hybrid Segmentation Internet
Gateway Remote Access
Securely deploy
applications & extend your
data center into AWS
Separate data and
applications for compliance
and security
Protect Internet facing
applications
Security consistency for
your network, your cloud,
and your devices

35. > DCD Summit | Interpol World
AUTO SCALING OF INSTANCES
Cyber Monday
Start of work
day
Tax season
Snow day
Provisioned
Capacity
On-demand
scaling
Predictable
Less predictable

36. AUTO SCALING OF SECURITY SERVICES
Cyber Monday
Start of work day
Tax season
Snow day
Provisioned
capacity
On-demand
scaling
Predictable
Less
predictable

37. RESOURCES TO ACCELERATE DEPLOYMENTS
https://live.paloaltonetworks.com/cloudtemplate

38. Secure OS and app
within workloads
HOST
2

39. Lightweight
Agent
Real-time Exploit and
Malware Protection
Protects Unpatched
Workloads
TRAPS: WORKLOAD PROTECTION
APP
WORKLOAD
Multi-method
Attack Prevention
Traps
Advanced
Endpoint
Protections
NEW

40. § Identity Access Management: Do passwords match policy? Is MFA used? Do only entitled users have
access?
§ Key Rotation & Management: Are keys being rotated adequately?
§ Security Monitoring & Logs: Is logging turned on?
§ Firewall / Security Group / ACL Configuration: What systems/people have access?
§ Load Balancer Configuration: Is it configured correctly? Are you using VPC security groups on ELBs?
§ VPC / Subnet Management: Do you have any empty VPCs? Are you nearing the EC2 Security Group limit for
your VPC?
§ Snapshot Management: Do we have a recent snapshot stored?
§ User & Access Management: Who has access to what resources/accounts? What actions did they take?
§ Data Encryption: Is encryption turned on for data at rest? In motion?
HOW ON MULTI-CLOUD ?

41. And Many More….Across Cloud…

42. Continuous security
& compliance
API
3

43. THE SOLUTION : EVIDENT.IO
CUSTOMER DATA
OS/PATCH MGMT IMAGE/SNAPSHOTS USER ACCESS MGMT
CLOUD INFRASTRUCTURE
SECURITY MONITORING
& LOGGING
ENCRYPTION / KEY
ROTATION
VPC / SUBNET SERVICE CONFIGURATION
SECURITY GROUPS
ACCESS MANAGEMENT
COMPUTE STORAGE DATABASE NETWORKING
YOUR
RESPONSIBLITY
THE CSP’s
RESPONSIBLITY
API
CONTROL
PLANE
WHERE EVIDENT
HELPS
CLOUD SERVICES

44. EVIDENT.IO ADDRESSES ALL REQUIREMENTS
• Deep integration and
extensibility
• Full understanding of
configuration and user
behavior
• Automated policy
enforcement
• Full regulatory
coverage: HIPAA, PCI,
NIST, GDPR…
• Full industry coverage:
CIS, ISO, SOC2…
• Customizable
compliance reports and
controls
Continuous
discovery
and monitoring
Complete and
continuous
compliance
reporting
• Risk exposure
• Malware analysis and
prevention
• Sensitive data discovery
• Content data discovery
Comprehensive
storage
security

45. EVIDENT.IO
1-CLICK
REPORTING
MULTI-CLOUD
CONTINUOUS
& REAL-TIME
BUILT FOR DEVOPS,
SECOPS, COMPLIANCE
AGENTLESS
CUSTOMIZE TO
MATCH YOUR POLICY
PALO ALTO NETWORKS - EVIDENT.IO

46. EVIDENT.IO

47. WHAT MAKES EVIDENT UNIQUE?
• Customization
• Ability to monitor AWS services
• Continuous scanning and alerting
• Agentless integration
• Out-of-the-box compliance frameworks
• Automated policy enforcement and guided remediation

48. TRY IT TODAY !!!

49. PHYSICAL
NETWORK
MOBILE
PRIVATE
CLOUD
SUMMARY : CONSISTENT, FRICTIONLESS PREVENTION
EVERYWHERE
IAAS
SAAS
PAAS

50. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Thank You