Come Out From Behind Your Firewall

1. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Christopher Schrom
Technical Account Manager
Bill Baldwin
Global Enterprise Support Lead
Come Out From Behind Your Firewall

2. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
• Traditional Security
• Cloud Security
• Amazon GuardDuty
• What is DevSecOps?
Agenda

3. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Traditional Security
Tales from the On-Prem world

4. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Stay Secure Move Fast
Before On-Prem …
OR

5. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
In the Beginning
We had firewalls
Bad traffic was kept out
Good traffic stayed in

6. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
The Packet Filter

7. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
The Stateful Firewall

8. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Firewalls Were Great!!
Segregation
and Isolation
Block and
Allow
Traffic
Inspection

9. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Life was good, we loved our firewalls…

10. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
So we thought…

11. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
New Threats
Malware and Viruses
Internal Threats
DDoS Attacks

12. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
So we found new ways to protect our networks…
Virus Detection
Malware Detection
Intrusion Detection (IDS)
Intrusion Protection (IPS)
NextGen Firewall - Layer 7
Protection
DNS Protection

13. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Challenges with this model
Reactive
False positives
Low degree of context
Limited automation
Difficult to scale

14. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Security is Complicated

15. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
“And now WE are helping to …
put the NO in Innovation”

16. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Cloud Security
The next chapter …

17. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
ORANDStay Secure Move Fast
Security in the Cloud …

18. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Security On-Prem
- Netflow Logs
- IDS Logs
Detect
- Firewalls
- IDS/IPS
Infrastructure
- Incident Response
- Scripts
Response

19. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Security in AWS
- CloudTrail
- VPC Flow Logs
- CloudWatch
Detect
- Amazon VPC
- Amazon GuardDuty
- AWS WAF
Infrastructure
- AWS Lambda
- AWS Config Rules
Response

20. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Threat Lifecycle
Monitor Response Remediate

21. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Monitor

22. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Monitor
CloudTrail
VPC Flow Logs
CloudWatch

23. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Monitor – CloudTrail – Create

24. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Monitor – CloudTrail – All Regions

25. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Monitor – CloudTrail – Verify
..for All AWS Regions.

26. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
AWS Management Console API / JSON Format
Monitor - CloudTrail
..and verify an API event.

27. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Monitor – VPC Flow Log
VPC Subnet
172.31.0.0/16
Elastic Network
Interface (ENI)

28. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Monitor – VPC Flow Log – Create Flow Log

29. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Monitor – VPC Flow Log – Specify information

30. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Monitor – VPC Flow Log – Verify

31. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
VPC Flow Log Event
Monitor – VPC Flow Log
...and verify an event.

32. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Respond

33. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Respond - Questions
How should I respond?
Who to notify?

34. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Respond - Example
Amazon
SNS
Lambda
function
Triggers Lambda
function
Root user’s AWS
account activity event
detected
Amazon
CloudWatch
Event
Sends email
notification
Publishes
Message

35. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Event Response – Example Email

36. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Remediate

37. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Remediate - Example
Isolate an instance into a blocked Security Group
Automate using Lambda

38. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Amazon GuardDuty
Continuous Monitoring, Event Response, and Automated
Remediation

39. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Amazon GuardDuty

40. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
GuardDuty Severity Levels
LOW MEDIUM HIGH
Suspicious or malicious
activity blocked before it
compromised a resource.
Suspicious activity deviating
from normally observed
behavior.
Resource compromised and
actively being used for
unauthorized purpose.

41. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
GuardDuty - Example of Findings
CloudWatch Event
• Finding Type
• Severity
• Region
• Account ID
• Date
• Resource ID

42. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
CloudWatch Events
Amazon
CloudWatch
CloudWatch
Event
Lambda
Lambda
Function
AWS Lambda
GuardDuty
Amazon
GuardDuty
Automated threat remediation

43. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
What is DevSecOps?

44. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
What is DevOps
developers customers
releasetestbuild
plan monitor
delivery pipeline
feedback loop
Software development lifecycle

45. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
What is DevSecOps
developers customers
releasetestbuild
plan monitor
delivery pipeline
feedback loop
Software development lifecycle
Security

46. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Amazon
Route 53
Amazon
EC2
Instances
Application
Load Balancer
Amazon
CloudFront
AWS WAFDDoS
Attack
Users
Third-
party IP
reputation
lists
What is DevSecOps
AWS Lambda IP
Lists Parser
Automated DDoS Protection

47. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Cultural Philosophy
Monitor
Analyze
Respond
Monitor
Analyze
Monitor
Respond
Analyze
Monitor
Remediate
Automation + Tools
Exploit
Testing
DDoS
Mitigation
Dynamic Threat
Assessment
Shared
Intelligence
Secure CI/CD

48. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
• Traditional Security
• Cloud Security
• Amazon GuardDuty
• What is DevSecOps?
Summary

49. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Thank You!
Bill Baldwin: bbaldwin@amazon.com
Chris Schrom: schromc@amazon.com

50. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Reference Material
Monitor
VPC Flow: https://amzn.to/1TneGVz
Respond
CloudTrail: https://amzn.to/2JiwPTS
Event Response: https://amzn.to/2F9kPle
Automated DDoS Protection
https://amzn.to/2mYNX6A