This session is recommended for technical users who want to know how the day-to-day work of securing their on-premise workloads should changes when moving to the cloud. Learn how to increase the effectiveness of your security operations as you move to the cloud. We will discuss how your current incident response, forensic investigations, monitoring, and audit response tactics have to change in the cloud. Pulling from experiences helping clients move to the cloud, industry research, and the school of hard knocks, this talk will help provide practical advice you can apply today.

1. © 2014 Amazon.com, Inc. and its affiliates. All rights reserved. May not be copied, modified, or distributed in whole or in part without the express consent of Amazon.com, Inc.
Updating Security Operations
For The Cloud
Justin Foster
Senior Product Manager, Cloud & Data Center Security
Trend Micro

6. G’Day Eh?

8. Strategy Tactics

9. Tactics

10. Tactics
Auditing
Monitoring
Incident Response
Forensic Investigations

11. Traditional Responsibility Model
Operating System
Application
Account Management
You
Facilities
Physical Security
Physical Infrastructure
Network Infrastructure
Virtualization
Infrastructure

12. Shared Responsibility Model
You
Operating System
Application
Account Management
Security Groups
Network
Configuration
AWS
Facilities
Physical Security
Physical Infrastructure
Network Infrastructure
Virtualization
Infrastructure

13. Before After
Structure
Bonus

14. Auditing

15. PCI Compliance

16. Requirements
Encrypting data at rest (3.4.1)
Address new threats & vulnerabilities (6.6)
Log external facing services & defences (10.2, 10.5.4)
Protect systems against malware (5.1)
* PCI has many, many more requirements, this is just a sample

17. Creating an audit trail, before
Servers
Storage Area Network
On-premises
Firewall
IPS
Central logging
Change
Records
Report

18. Payment
Client Data
On-premises AWS
Amazon CloudTrail
EC2 instances
Central management
Amazon S3
Amazon CloudFrontAmazon RDS
Creating an audit trail, after
Report

19. Creating an audit trail, bonus points
You get
Record of changes via AWS CloudTrail
Security control reporting via Deep Security’s API
Why it matters
Regular assurance controls are in place

20. In action…

22. Monitoring

23. Visibility

24. Requirements
Basic event info (5W+H)
Context of the event
Consistent identity across environments
Timely

25. Visibility, before
On-premises
FirewallIPS
Central logging SIEM
SwitchSwitchSwitchDirectory Server

26. AWS
Amazon CloudTrail
EC2 instances
Amazon S3 Bucket
Amazon CloudFrontAmazon RDS
Visibility, after
Central loggingSIEM
Amazon S3

27. Visibility, bonus points
You get
More work to put together events
Richer context around events
Why it matters
Visibility is key to your security practice

28. In action…

32. Incident Response

33. Under pressure

34. SANS incident response process
Preparation
Identification
Containment
Eradication
Recovery
Lessons Learned
Get ready!
What is it?
Did we get it?
Is it gone?
Again?
Get better, fast!

35. Requirements
Quickly identify affected area
Minimize impact
Recovery quickly

36. Server
On-premises
Incident Response, before
Replacement
Analysis Report Improve

37. AWS
Incident Response, after
Instance
Analysis Report Improve
Replacement

38. Incident Response, bonus points
You get
Faster return to production
More time for analysis
Why it matters
Every minute of downtime counts

39. In action…

41. Instance Analysis Report
Analyst
Optimized Response
LogProcessorAPI Improve
Replacement

42. Forensic Investigations

43. Rinse & Repeat

44. Perception

45. Reality

46. Reality, visualized

47. Requirements
Repeatable
Account for & prove each step
Not get in the way of recovery
Heavily documented

48. Forensics, before
Server
On-premises
Logs Analysis Testimony
Copy

49. AWS
Forensics, after
Instance
Logs Analysis Testimony
Copy

50. Forensics, bonus points
You get
Faster analysis & lower costs
Ability to replicate entire environment
Why it matters
Legal requirements
Better defences

51. In action…

52. Original
Concurrent
Analysis
Examiner
Commands Copy 1
Copy 2
Copy 0
Analysis

53. Keys

54. Auditing Monitoring IR Forensics

56. Thank you.
Justin Foster
justin_foster@trendmicro.com
@justin_foster
Care of: Mark Nunnikhoven @marknca

57. © 2014 Amazon.com, Inc. and its affiliates. All rights reserved. May not be copied, modified, or distributed in whole or in part without the express consent of Amazon.com, Inc.