In this session, learn how to address threat detection and remediation at AWS. We summarize the challenges of traditional threat-detection efforts and explain how AWS helps you address them in a cloud environment. We also provide an overview of key AWS services that detect and remediate threats, such as Amazon GuardDuty. Be sure to also check out the corresponding Threat Detection chalk talk.

1. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Threat detection and mitigation in
AWS
Nathan Case
Sr. Solutions Architect, Security Specialist
Amazon Web Services
S E C 2 0 1

2. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
© 2018, Amazon Web Services, Inc. or Its Affiliates. All rights reserved.
AWS IAM
AWS Organizations
AWS Cognito
AWS Directory Service
AWS Single Sign-On
AWS CloudTrail
AWS Config
Amazon
CloudWatch
Amazon GuardDuty
VPC Flow Logs
Amazon EC2
Systems Manager
AWS Shield
AWS WAF
Amazon Inspector
Amazon VPC
AWS KMS
AWS CloudHSM
Amazon Macie
AWS Certificate Manager
Server-side encryption
AWS Config rules
AWS Lambda
AWS Enterprise Support
Identity
Detective
control
Infrastructure
security
Incident
response
Data
protection
AWS security solutions

3. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
AWS security services overview
Protect Detect Respond
Automate
Investigate
RecoverIdentify
ArchiveSnapshot

4. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Why is traditional threat detection so hard?
CostSignal to noiseLarge datasets

5. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Humans and data donʼt mix

6. S U M M I T © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.

7. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
AWS CloudTrail
Track user activity
and API usage
VPC Flow Logs
IP traffic to/from
network interfaces in
your VPC
Amazon
CloudWatch Logs
Monitor apps using log
data, store, and access log
files
DNS logs
Log of DNS queries in
a VPC when using the
VPC DNS resolver
Threat detection: Log data inputs

8. S U M M I T © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.
AWS CloudTrail

9. S U M M I T © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Detect with Amazon VPC Flow Logs
AWS
account
Source IP
Destination IP
Source port
Destination port
Interface Protocol Packets
Bytes Start and end time
Accept or
reject

10. S U M M I T © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.
• Real-time feed of log events
• Delivered to an Lambda function or an
Amazon Kinesis data streams
• Supports custom processing, analysis,
and loading into other systems
• Cross-account data sharing for
centralized log processing
Amazon CloudWatch Logs subscriptions

11. S U M M I T © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.

12. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
GuardDuty
Intelligent threat detection and continuous
monitoring to protect your AWS accounts
and workloads
AWS Security Hub
Security Hub gives you a comprehensive view
of your high-priority security alerts and
compliance status across AWS accounts.
Threat detection

13. S U M M I T © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Amazon GuardDuty threat detection and notification

14. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
AWS Security Hub overview

15. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Security Hub benefits
Managed regional AWS service; aggregates findings across AWS
accounts in minutes
Manage security and compliance findings in a single location, increasing
efficiency of locating relevant data
Create custom insights to track issues unique to your environment

16. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Security Hub workflow
Enable Security Hub for
all your accounts
Account 1
Account 2
Account 3
Conduct automated
compliance scans and
checks
Take action based
on findings
Continuously
aggregate and
prioritize findings

17. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Compliance standards
• Based on CIS AWS Foundations Benchmark
• Findings are displayed on main dashboard for quick
access
• Best-practices information is provided to help mitigate
issues
Compliance
standards

18. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Security Hub insights
Security findings that are correlated and grouped for prioritization
• More than 20 prebuilt insights provided by AWS and AWS Partner Network
members
• Ability to create your own insights
• Dashboard provides visibility into the top security findings
• Additional details for each finding is available for review
EC2 instances that have
missing security patches
S3 buckets with stored
credentials
S3 buckets with public read and
write permissions

19. S U M M I T © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.
What can you detect using AWS services?
Infrastructure
VPC resources
Connectivity
On-instance
...
Service
IAM
S3 buckets
Billing
...
Application
Patching
Coding hole
...
Other?

20. S U M M I T © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Availability Zone C
Availability Zone B
VPC CIDR: 10.0.0.0/16
Availability Zone A
10.0.0.0/19
Public subnet
10.0.32.0/20
Private subnet
10.0.48.0/21
Sensitive subnet
Security groups
Route table
NACLs
Internet gateway
Instance
Amazon
S3
Amazon
RDS
AWS IAM
AWS
CloudHSM
AWS
Organizations
AWSKMS
AWS Directory
Service
Infrastructure and application domains

21. S U M M I T © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Services Domain
Availability Zone C
Availability Zone B
VPC CIDR: 10.0.0.0/16
Availability Zone A
10.0.0.0/19
Public subnet
10.0.32.0/20
Private subnet
10.0.48.0/21
Sensitive subnet
Security groups
Route table
NACLs
Internet gateway
Instance
Amazon
S3
Amazon
RDS
AWS IAM
AWS
CloudHSM
AWS
Organizations
AWSKMS
AWS Directory
Service
Services domains

22. S U M M I T © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.
All Domains
Availability Zone C
Availability Zone B
VPC CIDR: 10.0.0.0/16
Availability Zone A
10.0.0.0/19
Public subnet
10.0.32.0/20
Private subnet
10.0.48.0/21
Sensitive subnet
Security groups
Route table
NACLs
Internet gateway
Instance
Amazon
S3
Amazon
RDS
AWS IAM
AWS
CloudHSM
AWS
Organizations
AWSKMS
AWS Directory
Service
What can you detect using AWS services?

23. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Visibility to answer the tough questions
• What data do I have in the cloud?
• Where is it located?
• Where does my sensitive data exist?
• What’s sensitive about the data?
• What PII/PHI is possibly exposed?
• How is data being shared and stored?
• How and where is my data accessed?
• How can I classify data in near-real time?
• How do I build workflow remediation for my security and compliance needs?

24. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Visibility to answer the tough questions
Amazon Web Services has opened case ******** on your behalf.
The details of the case are as follows:
Case ID: ********
Subject: Your AWS account ******** is compromised
Severity: Urgent
Correspondence: Dear AWS Customer,
Your AWS Account is compromised! Please review the following notice and take
immediate action to secure your account.
Your security is important to us. We have become aware that the AWS Access Key
******** along with the corresponding Secret Key is publicly available online at
********…

25. S U M M I T © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.

26. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Amazon CloudWatch Events
Delivers a near-real-time stream of system
events that describe changes in AWS resources
AWS Config rules
Continuously tracks your resource
configuration changes and if they violate
any of the conditions in your rules
Threat detection: Triggers

27. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
AWS Config rules
A continuous recording and assessment service
Changing resources
AWS Config
AWS Config rules
History
snapshot
Notifications
API access
Normalized
• How are my resources configured over time?
• Is a change that just occurred to a resource compliant?

28. S U M M I T © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.
CloudWatch Events
{
"source": [
"aws.guardduty"
]
}
CloudWatch Event
GuardDuty
findings
Lambda
function

29. S U M M I T © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.

30. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
AWS Systems
Manager
Automate patching and
proactively mitigate threats at
the instance level
AWS Lambda
Capture info about the IP traffic
going to and from network
interfaces in your VPC
Threat remediation: Automation

31. S U M M I T © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.
High-level playbook
Adversary or intern Your
environment
Lambda
responder
CloudWatch
Events
AWS Step
Functions

32. S U M M I T © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.
CloudWatch
CloudTrail
AWS Config
Lambda
function
AWS APIs
AWS WAF
AWS Shield
Detection
Alerting
Remediation
Countermeasures
Forensics
Team
collaboration
(Slack, etc.)
GuardDuty
VPC Flow Logs
Step Functions
Systems Manager Amazon EC2
Responding to findings: Remediation

33. S U M M I T © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.

34. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Hopefully, you've seen this already
Developer
sandbox
Dev Pre-prod
Team/group accounts
Security
Core accounts
AWS Organizations
Shared
services
Network
Log archive Prod
Team shared
services
Network path
Developer accounts Data center
Orgs: Account management
Log archive: Security logs
Security: Security tools, AWS Config rules
Shared services: Directory, limit monitoring
Network: AWS Direct Connect
Dev sandbox: Experiments, learning
Dev: Development
Pre-prod: Staging
Prod: Production
Team SS: Team shared services, data lake

35. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Services
Security
Core accounts
AWS Organizations
Shared
services
Network
Log archive
Network path
Data center
Orgs: Account management
Log archive: Security logs
Security: Security tools, AWS Config rules
Shared services: Directory, limit monitoring
Network: DX
Dev sandbox: Experiments, learning
Dev: Development
Pre-prod: Staging
Prod: Production
Team SS: Team shared services, data lake

36. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Developers
Developer
sandbox
Team/group accounts
AWS Organizations
Network path
Developer accounts Data center
Orgs: Account management
Log archive: Security logs
Security: Security tools, AWS Config rules
Shared services: Directory, limit monitoring
Network: DX
Dev sandbox: Experiments, learning
Dev: Development
Pre-prod: Staging
Prod: Production
Team SS: Team shared services, data lake

37. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Connections to team accounts
Developer
sandbox
Team/group accounts
AWS Organizations
Network path
Developer accounts Data center
Orgs: Account management
Log archive: Security logs
Security: Security tools, AWS Config rules
Shared services: Directory, limit monitoring
Network: DX
Dev sandbox: Experiments, learning
Dev: Development
Pre-prod: Staging
Prod: Production
Team SS: Team shared services, data lake
Core accounts
Dev Pre-prod
Team/group accounts
Prod
Team shared
services

38. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Team versus production accounts
Dev
Prod green
Team/group accounts
Prod blue
Dev pipeline account
Network path
Data center
Orgs: Account management
Log archive: Security logs
Security: Security tools, AWS Config rules
Shared services: Directory, limit monitoring
Network: DX
Dev sandbox: Experiments, learning
Dev: Development
Pre-prod: Staging
Prod: Production
Team SS: Team shared services, data lake
Testing account
Prod pipeline account
Network
Prod/group accounts

39. S U M M I T © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.

41. S U M M I T © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.

42. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
© 2018, Amazon Web Services, Inc. or Its Affiliates. All rights reserved.
Lambda + Systems Manager + CloudWatch
AWS Systems
Manager
documents
Amazon
CloudWatch
rule
AWS
Lambda
Lambda
function
AWS Step Functions
Amazon GuardDuty
AWS Security Hub

43. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
© 2018, Amazon Web Services, Inc. or Its Affiliates. All rights reserved.
AWS Systems
Manager
documents
Amazon
CloudWatch
rule
AWS
Lambda
Lambda
function
AWS Step Functions
BACKDOOR:EC2/XORDDOS
Amazon GuardDuty
AWS Security Hub
Lambda + Systems Manager + CloudWatch

44. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
© 2018, Amazon Web Services, Inc. or Its Affiliates. All rights reserved.
AWS Systems
Manager
documents
Amazon
CloudWatch
rule
AWS
Lambda
Lambda
function
AWS Step Functions
GUARD DUTY FINDINGS
Amazon GuardDuty
AWS Security Hub
Lambda + Systems Manager + CloudWatch

45. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
© 2018, Amazon Web Services, Inc. or Its Affiliates. All rights reserved.
AWS Systems
Manager
documents
Amazon
CloudWatch
rule
AWS
Lambda
Lambda
function
AWS Step Functions
BACKDOOR:EC2/XORDDOS
Amazon GuardDuty
AWS Security Hub
Lambda + Systems Manager + CloudWatch

46. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
© 2018, Amazon Web Services, Inc. or Its Affiliates. All rights reserved.
AWS Systems
Manager
documents
Amazon
CloudWatch
rule
AWS
Lambda
Lambda
function
AWS Step Functions
BACKDOOR:EC2/XORDDOS
COMMUNICATIONS
MANUAL ACTION
Amazon GuardDuty
AWS Security Hub
Lambda + Systems Manager + CloudWatch

47. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
© 2018, Amazon Web Services, Inc. or Its Affiliates. All rights reserved.
AWS Systems
Manager
documents
Amazon
CloudWatch
rule
AWS
Lambda
Lambda
function
AWS Step Functions
BACKDOOR:EC2/XORDDOS
COMMUNICATIONS
MANUAL ACTION
Via Amazon API Gateway*
Amazon GuardDuty
AWS Security Hub
Lambda + Systems Manager + CloudWatch

48. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
© 2018, Amazon Web Services, Inc. or Its Affiliates. All rights reserved.
AWS Systems
Manager
documents
Amazon
CloudWatch
rule
EC2 instance contents
Instance:~ ec2-user$
AWS
Lambda
Lambda
function
AWS Step Functions
BACKDOOR:EC2/XORDDOS
elastic network
interface
Security Group
EBS Volume
IAM Profile
Amazon GuardDuty
AWS Security Hub
Lambda + Systems Manager + CloudWatch

49. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
© 2018, Amazon Web Services, Inc. or Its Affiliates. All rights reserved.
AWS Systems
Manager
documents
Amazon
CloudWatch
rule
AWS
Lambda
Lambda
function
AWS Step Functions
BACKDOOR:EC2/XORDDOS
Amazon GuardDuty
AWS Security Hub
Lambda + Systems Manager + CloudWatch

50. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
© 2018, Amazon Web Services, Inc. or Its Affiliates. All rights reserved.
AWS Systems
Manager
documents
Amazon
CloudWatch
rule
EC2 instance contents
Instance:~ ec2-user$
AWS
Lambda
Lambda
function
AWS Step Functions
BACKDOOR:EC2/XORDDOS
elastic network
interface
Security Group
EBS Volume
IAM Profile
EBS
Snapshot
Amazon GuardDuty
AWS Security Hub
Lambda + Systems Manager + CloudWatch

51. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
© 2018, Amazon Web Services, Inc. or Its Affiliates. All rights reserved.
AWS Systems
Manager
documents
Amazon
CloudWatch
rule
EC2 instance contents
Instance:~ ec2-user$
AWS
Lambda
Lambda
function
AWS Step Functions
BACKDOOR:EC2/XORDDOS
elastic network
interface
Security Group
EBS Volume
IAM Profile
Amazon S3
bucket
AWS
CloudTrail
EBS
Snapshot
Amazon GuardDuty
AWS Security Hub
Lambda + Systems Manager + CloudWatch

52. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
© 2018, Amazon Web Services, Inc. or Its Affiliates. All rights reserved.
AWS Systems
Manager
documents
Amazon
CloudWatch
rule
EC2 instance contents
Instance:~ ec2-user$
AWS
Lambda
Lambda
function
AWS Step Functions
BACKDOOR:EC2/XORDDOS
elastic network
interface
Security Group
EBS Volume
IAM Profile
EBS
Snapshot
AWS
CloudTrail
Amazon S3
bucket
Forensics Account
Amazon GuardDuty
AWS Security Hub
Lambda + Systems Manager + CloudWatch

53. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
© 2018, Amazon Web Services, Inc. or Its Affiliates. All rights reserved.
AWS Systems
Manager
documents
Amazon
CloudWatch
rule
EC2 instance contents
Instance:~ ec2-user$
AWS
Lambda
Lambda
function
AWS Step Functions
BACKDOOR:EC2/XORDDOS
Amazon GuardDuty
AWS Security Hub
Lambda + Systems Manager + CloudWatch

54. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
© 2018, Amazon Web Services, Inc. or Its Affiliates. All rights reserved.
AWS Systems
Manager
documents
Amazon
CloudWatch
rule
EC2 instance contents
Instance:~ ec2-user$
Instance:~ ec2-user$ top
Instance:~ ec2-user$ pcap
Instance:~ ec2-user$ lime
Instance:~ ec2-user$ dd
AWS
Lambda
Lambda
function
AWS Step Functions
BACKDOOR:EC2/XORDDOS
EBS Volume
IAM Profile
Amazon GuardDuty
AWS Security Hub
Lambda + Systems Manager + CloudWatch

55. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
© 2018, Amazon Web Services, Inc. or Its Affiliates. All rights reserved.
AWS Systems
Manager
documents
Amazon
CloudWatch
rule
EC2 instance contents
Instance:~ ec2-user$
Instance:~ ec2-user$ top
Instance:~ ec2-user$ pcap
Instance:~ ec2-user$ lime
Instance:~ ec2-user$ dd
AWS
Lambda
Lambda
function
AWS Step Functions
BACKDOOR:EC2/XORDDOS
EBS Volume Forensics
EBS IAM Profile
Amazon GuardDuty
AWS Security Hub
Lambda + Systems Manager + CloudWatch

56. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
© 2018, Amazon Web Services, Inc. or Its Affiliates. All rights reserved.
AWS Systems
Manager
documents
Amazon
CloudWatch
rule
AWS
Lambda
Lambda
function
AWS Step Functions
BACKDOOR:EC2/XORDDOS
Forensics
EBS
EBS
Snapshot
Amazon S3
bucket
Forensics Account
Amazon GuardDuty
AWS Security Hub
Lambda + Systems Manager + CloudWatch

57. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
© 2018, Amazon Web Services, Inc. or Its Affiliates. All rights reserved.
AWS Systems
Manager
documents
Amazon
CloudWatch
rule
AWS
Lambda
Lambda
function
AWS Step Functions
BACKDOOR:EC2/XORDDOS
Forensics
EBS
EBS
Snapshot
Amazon S3
bucket
Forensics Account
Amazon GuardDuty
AWS Security Hub
Lambda + Systems Manager + CloudWatch

58. S U M M I T © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.
AWS Systems
Manager
documents
Amazon
CloudWatch
rule
AWS
Lambda
Lambda
function
AWS Step Functions
BACKDOOR:EC2/XORDDOS
Forensics
EBS
EBS
Snapshot
Amazon S3
bucket
Forensics Account
EASIER DONE THAN SAID.
Amazon GuardDuty
AWS Security Hub
Lambda + Systems Manager + CloudWatch

59. S U M M I T © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.

60. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
CloudWatch
CloudTrail
AWS Config
Lambda
function
APIs
AWS WAF
AWS Shield
Detection
Alerting
Remediation
Countermeasures
Forensics
Team
collaboration
(Slack, etc.)
GuardDuty
VPC Flow Logs
AWS Step Functions
Systems Manager Amazon EC2
Responding to findings: Remediation

61. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Remediating threats on EC2 instances
• Asynchronously execute
commands
• No need to SSH/RDP
• Commands and output logged
Systems Manager – Run command
EC2 instances
Lambda
function
Systems Manager
Amazon
EC2

62. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Open-source resources
Prowler
https://github.com/toniblyx/prowler
Cloud Custodian
https://github.com/capitalone/cloud-custodian
Security Monkey
https://github.com/Netflix/security_monkey
Scout2
https://github.com/nccgroup/Scout2
StreamAlert
https://github.com/airbnb/streamalert
CIS AWS Foundations Framework
https://github.com/awslabs/aws-security-benchmark
MozDef
https://github.com/mozilla/MozDef

63. Thank you!
S U M M I T © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Nathan Case
Sr. Solutions Architect, Security Specialist
Amazon Web Services
https://www.linkedin.com/in/nathancase/