Learn how to increase the effectiveness of your security operations as you move to the cloud. We will discuss how your current incident response, forensic investigations, monitoring, and audit response tactics have to change in the cloud. Pulling from experiences helping clients move to the cloud, industry research, and the school of hard knocks, this talk will help provide practical advice you can apply today.

1. © 2014 Amazon.com, Inc. and its affiliates. All rights reserved. May not be copied, modified, or distributed in whole or in part without the express consent of Amazon.com, Inc.
Updating Security Operations For The Cloud
Mark Nunnikhoven
Vice President, Cloud & Emerging Technologies
Trend Micro
26-Mar-2014

2. Overview

3. Strategy Tactics

4. Tactics

5. Tactics
Auditing
Monitoring
Incident Response
Forensic Investigations

6. Traditional Responsibility Model
!
Operating System
Application
Account Management*
You
Facilities
Physical Security
Physical Infrastructure
Network Infrastructure
Virtualization Infrastructure

7. Shared Responsibility Model
You
Operating System
Application
Account Management*
Security Groups*
Network Configuration*
AWS
Facilities
Physical Security
Physical Infrastructure
Network Infrastructure
Virtualization Infrastructure

8. Our story

9. Hybrid architecture
On-premises Cloud

10. Full architecture
Payment
Client Data
On-premises
AWS
Payment
Games
Store
Logs
Content
Viewers
Client Data

11. Full architecture, expansion
AWS
Payment
Games
Store
Logs
Content
Viewers
Client Data
Payment
Client Data
On-premises

12. Full architecture, AWS services
AWS
Payment
Games
Store
Logs
Content
Viewers
Client Data
Amazon EC2
Amazon EC2
Amazon EC2
Amazon CloudFront
Amazon S3
Amazon EC2Amazon RDS
Payment
Client Data
On-premises

13. Before After
Structure
Bonus

14. Auditing

15. PCI Compliance

16. Requirements
Encrypting data at rest (3.4.1)
Address new threats & vulnerabilities (6.6)
Log external facing services & defences (10.2, 10.5.4)
Protect systems against malware (5.1)
* PCI has many, many more requirements, this is just a sample

17. Creating an audit trail, before
Servers
Storage Area Network
On-premises
Firewall
IPS
Central logging

18. Payment
Client Data
On-premises AWS
Amazon CloudTrail
EC2 instances
Central management
Amazon S3
Amazon CloudFrontAmazon RDS
Creating an audit trail, after

19. Creating an audit trail, bonus points
You get
Record of changes via AWS CloudTrail
Security control reporting via Deep Security’s API
Why it matters
Regular assurance controls are in place

20. In action…

22. Monitoring

23. Visibility

24. Requirements
Basic event info (4W+H)
Context of the event
Consistent identity across environments
Timely

25. Visibility, before
On-premises
FirewallIPS
Central logging SIEM
SwitchSwitchSwitchDirectory Server

26. AWS
Amazon CloudTrail
EC2 instances
Amazon S3 Bucket
Amazon CloudFrontAmazon RDS
Visibility, after
Central loggingSIEM
Amazon S3

27. Visibility, bonus points
You get
More work to put together events
Richer context around events
Why it matters
Visibility is key to your security practice

28. In action…

32. Incident Response

33. Under pressure

34. SANS incident response process
Preparation
Identification
Containment
Eradication
Recovery
Lessons Learned
Get ready!
What is it?
Did we get it?
Is it gone?
Again?
Get better, fast!

35. Requirements
Quickly identify affected area
Minimize impact
Recovery quickly

36. Server
On-premises
Analysis Report
Incident Response, before
Replacement
Improve

37. AWS
Incident Response, after
Server
Analysis Report
Replacement
Improve

38. Incident Response, bonus points
You get
Faster return to production
More time for analysis
Why it matters
Every minute of downtime counts

39. In action…

41. Server Analysis Report
Analyst
Optimized Response
LogProcessor
Replacement
API Improve

42. Forensic Investigations

43. Rinse & Repeat

44. Perception

45. Reality

46. Reality, visualized

47. Requirements
Repeatable
Account for & prove each step
Not get in the way of recovery
Heavily documented

48. Forensics, before
Server
On-premises
Logs Analysis Testimony

49. AWS
Forensics, after
Instance
Logs Analysis Testimony

50. Forensics, bonus points
You get
Faster analysis & lower costs
Ability to replicate entire environment
Why it matters
Legal requirements
Better defences

51. In action…

52. Original
Concurrent
Analysis
Examiner
Copy 0
Copy 1
Copy 2
Commands

53. Keys

54. Auditing Monitoring IR Forensics

56. Thank you.
Mark Nunnikhoven
mark_nunnikhoven@trendmicro.com
@marknca