I created the baker's dozen of things to think about when migrating or deploying in AWS. Use comments to add your input. Read time approx. 15-20 minutes max.

1. ©2017 Lacework, Inc. Confidential and Proprietary.
.start

2. ©2017 Lacework, Inc. Confidential and Proprietary.
Bakers Dozen to Securing AWS

3. ©2017 Lacework, Inc. Confidential and Proprietary.
Dan Hubbard, Lacework

4. ©2017 Lacework, Inc. Confidential and Proprietary.
@dhubbard858

5. ©2017 Lacework, Inc. Confidential and Proprietary.
So, you are running in AWS?

6. ©2017 Lacework, Inc. Confidential and Proprietary.
AWS has amazing advantages….

7. ©2017 Lacework, Inc. Confidential and Proprietary.
Speed

8. ©2017 Lacework, Inc. Confidential and Proprietary.
Velocity

9. ©2017 Lacework, Inc. Confidential and Proprietary.
Auto-scale

10. ©2017 Lacework, Inc. Confidential and Proprietary.
They run the infrastructure.

11. ©2017 Lacework, Inc. Confidential and Proprietary.
And let you focus on your apps.

12. ©2017 Lacework, Inc. Confidential and Proprietary.
That is what matters.

13. ©2017 Lacework, Inc. Confidential and Proprietary.
But how do you secure all of this?

14. ©2017 Lacework, Inc. Confidential and Proprietary.
Think different.

15. ©2017 Lacework, Inc. Confidential and Proprietary.
It’s less about the castle and moat.

16. ©2017 Lacework, Inc. Confidential and Proprietary.
And more about automation.

17. ©2017 Lacework, Inc. Confidential and Proprietary.
scale.

18. ©2017 Lacework, Inc. Confidential and Proprietary.
visibility.

19. ©2017 Lacework, Inc. Confidential and Proprietary.
context.

20. ©2017 Lacework, Inc. Confidential and Proprietary.
And most importantly….

21. ©2017 Lacework, Inc. Confidential and Proprietary.
Shrinking your attack surface.

22. ©2017 Lacework, Inc. Confidential and Proprietary.
Minimizing mistakes.

23. ©2017 Lacework, Inc. Confidential and Proprietary.
And fitting security INTO your
architecture.

24. ©2017 Lacework, Inc. Confidential and Proprietary.
NOT in FRONT of it.

25. ©2017 Lacework, Inc. Confidential and Proprietary.
Where do we start?

26. ©2017 Lacework, Inc. Confidential and Proprietary.
Drive towards least-privilege
systems.

27. ©2017 Lacework, Inc. Confidential and Proprietary.
I know, you may not be there TODAY.

28. ©2017 Lacework, Inc. Confidential and Proprietary.
You may be migrating

29. ©2017 Lacework, Inc. Confidential and Proprietary.
Least Privilege is easier said than
done.

30. ©2017 Lacework, Inc. Confidential and Proprietary.
But it’s a destination you want to
drive to.

31. ©2017 Lacework, Inc. Confidential and Proprietary.
And if you have the luxury of starting
over.

32. ©2017 Lacework, Inc. Confidential and Proprietary.
then start with least privilege.

33. ©2017 Lacework, Inc. Confidential and Proprietary.
Start with templatized workload
configuration.

34. ©2017 Lacework, Inc. Confidential and Proprietary.
Terraform (multi-platform)

35. ©2017 Lacework, Inc. Confidential and Proprietary.
Cloudformation = AWS specific

36. ©2017 Lacework, Inc. Confidential and Proprietary.
Next select your orchestration
system.

37. ©2017 Lacework, Inc. Confidential and Proprietary.
Kubernetes

38. ©2017 Lacework, Inc. Confidential and Proprietary.
Docker Swarm

39. ©2017 Lacework, Inc. Confidential and Proprietary.
Mesos.

40. ©2017 Lacework, Inc. Confidential and Proprietary.
Choose your favorite container tech.

41. ©2017 Lacework, Inc. Confidential and Proprietary.
Likely Docker or equiv..

42. ©2017 Lacework, Inc. Confidential and Proprietary.
And finally your favorite OS.

43. ©2017 Lacework, Inc. Confidential and Proprietary.
CoreOS

44. ©2017 Lacework, Inc. Confidential and Proprietary.
Redhat

45. ©2017 Lacework, Inc. Confidential and Proprietary.
Ubuntu

46. ©2017 Lacework, Inc. Confidential and Proprietary.
OK, now let’s think about the
security...

47. ©2017 Lacework, Inc. Confidential and Proprietary.
Start with AWS Accounts.

48. ©2017 Lacework, Inc. Confidential and Proprietary.
Then your services

49. ©2017 Lacework, Inc. Confidential and Proprietary.
API’s

50. ©2017 Lacework, Inc. Confidential and Proprietary.
Compliance

51. ©2017 Lacework, Inc. Confidential and Proprietary.
Applications

52. ©2017 Lacework, Inc. Confidential and Proprietary.
Users

53. ©2017 Lacework, Inc. Confidential and Proprietary.
Secure your AWS account.1

54. ©2017 Lacework, Inc. Confidential and Proprietary.
Design your accounts carefully !

55. ©2017 Lacework, Inc. Confidential and Proprietary.
This is not easy to unwind and it’s
super important.

56. ©2017 Lacework, Inc. Confidential and Proprietary.
Balance accounts and
responsibilities.

57. ©2017 Lacework, Inc. Confidential and Proprietary.
Watch for sprawl.

58. ©2017 Lacework, Inc. Confidential and Proprietary.
You do not want to have too many
accounts.

59. ©2017 Lacework, Inc. Confidential and Proprietary.
If you have a reason for a LOT of
accounts.

60. ©2017 Lacework, Inc. Confidential and Proprietary.
Justify it !

61. ©2017 Lacework, Inc. Confidential and Proprietary.
Use AWS organizations.

62. ©2017 Lacework, Inc. Confidential and Proprietary.
MFA critical for all console
authentication.

63. ©2017 Lacework, Inc. Confidential and Proprietary.
Use instance roles for services.

64. ©2017 Lacework, Inc. Confidential and Proprietary.
Roles manage ephemeral keys
internally

65. ©2017 Lacework, Inc. Confidential and Proprietary.
CloudTrail2

66. ©2017 Lacework, Inc. Confidential and Proprietary.
Make sure it’s on for ALL accounts.

67. ©2017 Lacework, Inc. Confidential and Proprietary.
Log it in a place that you can query.

68. ©2017 Lacework, Inc. Confidential and Proprietary.
CloudTrail is very noisy

69. ©2017 Lacework, Inc. Confidential and Proprietary.
You need to understand the needles
in the data

70. ©2017 Lacework, Inc. Confidential and Proprietary.
Context is critical

71. ©2017 Lacework, Inc. Confidential and Proprietary.
Understand relevant change.

72. ©2017 Lacework, Inc. Confidential and Proprietary.
Change in config’s

73. ©2017 Lacework, Inc. Confidential and Proprietary.
Change in API usage

74. ©2017 Lacework, Inc. Confidential and Proprietary.
Change in critical services.

75. ©2017 Lacework, Inc. Confidential and Proprietary.
Change in user patterns.

76. ©2017 Lacework, Inc. Confidential and Proprietary.
Attackers can delete / turn off
CloudTrail

77. ©2017 Lacework, Inc. Confidential and Proprietary.
Segment S3 bucket with different
from monitored account

78. ©2017 Lacework, Inc. Confidential and Proprietary.
Secure Services3

79. ©2017 Lacework, Inc. Confidential and Proprietary.
EC2, S3, RDS, KMS...

80. ©2017 Lacework, Inc. Confidential and Proprietary.
Set a policy and a framework for
your services

81. ©2017 Lacework, Inc. Confidential and Proprietary.
Each service has unique attack
surface

82. ©2017 Lacework, Inc. Confidential and Proprietary.
How do you think about threats in
1000’s of services.

83. ©2017 Lacework, Inc. Confidential and Proprietary.
Lambda surface?

84. ©2017 Lacework, Inc. Confidential and Proprietary.
ECS ?

85. ©2017 Lacework, Inc. Confidential and Proprietary.
EKS ?

86. ©2017 Lacework, Inc. Confidential and Proprietary.
S3 ?

87. ©2017 Lacework, Inc. Confidential and Proprietary.
RDS ?

88. ©2017 Lacework, Inc. Confidential and Proprietary.
Redshift ?

89. ©2017 Lacework, Inc. Confidential and Proprietary.
Don’t boil the ocean YET.

90. ©2017 Lacework, Inc. Confidential and Proprietary.
Understand what you use, why, and
focus on those.

91. ©2017 Lacework, Inc. Confidential and Proprietary.
Learn what dev. is looking at next.

92. ©2017 Lacework, Inc. Confidential and Proprietary.
Compliance4

93. ©2017 Lacework, Inc. Confidential and Proprietary.
Your accounts and services need
continual checks

94. ©2017 Lacework, Inc. Confidential and Proprietary.
This is not your annual compliance
audit

95. ©2017 Lacework, Inc. Confidential and Proprietary.
Its all the time every time.

96. ©2017 Lacework, Inc. Confidential and Proprietary.
Start with CIS for AWS benchmarks

97. ©2017 Lacework, Inc. Confidential and Proprietary.
Expand into your relevant areas.

98. ©2017 Lacework, Inc. Confidential and Proprietary.
PCI

99. ©2017 Lacework, Inc. Confidential and Proprietary.
SOC II

100. ©2017 Lacework, Inc. Confidential and Proprietary.
HIPAA.

101. ©2017 Lacework, Inc. Confidential and Proprietary.
Secure the network.5

102. ©2017 Lacework, Inc. Confidential and Proprietary.
It’s not your network.

103. ©2017 Lacework, Inc. Confidential and Proprietary.
Yeah it’s virtual.

104. ©2017 Lacework, Inc. Confidential and Proprietary.
Limit what can go in and out.

105. ©2017 Lacework, Inc. Confidential and Proprietary.
Minimize in AND out.

106. ©2017 Lacework, Inc. Confidential and Proprietary.
Understand inter network traffic
(east-west)

107. ©2017 Lacework, Inc. Confidential and Proprietary.
But the network diminishes in
importance in cloud.

108. ©2017 Lacework, Inc. Confidential and Proprietary.
Like console access to the router

109. ©2017 Lacework, Inc. Confidential and Proprietary.
Firmare on edge router.

110. ©2017 Lacework, Inc. Confidential and Proprietary.
You don’t own it. Get used to that.

111. ©2017 Lacework, Inc. Confidential and Proprietary.
Network often static.

112. ©2017 Lacework, Inc. Confidential and Proprietary.
But systems are dynamic.

113. ©2017 Lacework, Inc. Confidential and Proprietary.
Containers and orchestration limit
relevance.

114. ©2017 Lacework, Inc. Confidential and Proprietary.
But monitor config’s still important
in VPC’s.

115. ©2017 Lacework, Inc. Confidential and Proprietary.
Secure the applications.6

116. ©2017 Lacework, Inc. Confidential and Proprietary.
What are they talking to?

117. ©2017 Lacework, Inc. Confidential and Proprietary.
And Why ?

118. ©2017 Lacework, Inc. Confidential and Proprietary.
Understand application topologies
and systems.

119. ©2017 Lacework, Inc. Confidential and Proprietary.
Gain insight into typical system
behavior

120. ©2017 Lacework, Inc. Confidential and Proprietary.
Understand outliers.

121. ©2017 Lacework, Inc. Confidential and Proprietary.
Log ALL application behaviors.

122. ©2017 Lacework, Inc. Confidential and Proprietary.
Abstract containers : translate apps :
containers : machines.

123. ©2017 Lacework, Inc. Confidential and Proprietary.
Did I mention log everything.

124. ©2017 Lacework, Inc. Confidential and Proprietary.
Ephemeral workloads must be
monitored

125. ©2017 Lacework, Inc. Confidential and Proprietary.
in near real-time.

126. ©2017 Lacework, Inc. Confidential and Proprietary.
Make meaning of the logs.

127. ©2017 Lacework, Inc. Confidential and Proprietary.
Good data turns into information
when it answers questions.

128. ©2017 Lacework, Inc. Confidential and Proprietary.
Who ran this app?

129. ©2017 Lacework, Inc. Confidential and Proprietary.
When did it run?

130. ©2017 Lacework, Inc. Confidential and Proprietary.
What did it do?

131. ©2017 Lacework, Inc. Confidential and Proprietary.
Where did it connect to?

132. ©2017 Lacework, Inc. Confidential and Proprietary.
Good data turns into information

133. ©2017 Lacework, Inc. Confidential and Proprietary.
when you either gain security
knowledge

134. ©2017 Lacework, Inc. Confidential and Proprietary.
or when your can answer questions
with context.

135. ©2017 Lacework, Inc. Confidential and Proprietary.
“Hey Dan, did you mean to install 50 new
GPU instances in the Europe Region running
Bitcoin Miners last night”?

136. ©2017 Lacework, Inc. Confidential and Proprietary.
Secure Users.7

137. ©2017 Lacework, Inc. Confidential and Proprietary.
Who can log into what machines.

138. ©2017 Lacework, Inc. Confidential and Proprietary.
Why?

139. ©2017 Lacework, Inc. Confidential and Proprietary.
Limit logins wherever you can!

140. ©2017 Lacework, Inc. Confidential and Proprietary.
Least Privileged systems.

141. ©2017 Lacework, Inc. Confidential and Proprietary.
If logins necessary….

142. ©2017 Lacework, Inc. Confidential and Proprietary.
NO SHARED ACCOUNTS

143. ©2017 Lacework, Inc. Confidential and Proprietary.
Unique accounts per user

144. ©2017 Lacework, Inc. Confidential and Proprietary.
Use MFA.

145. ©2017 Lacework, Inc. Confidential and Proprietary.
Setup a bastion.

146. ©2017 Lacework, Inc. Confidential and Proprietary.
3 Factors of ID..

147. ©2017 Lacework, Inc. Confidential and Proprietary.
Setup VPN

148. ©2017 Lacework, Inc. Confidential and Proprietary.
Limit access via IP

149. ©2017 Lacework, Inc. Confidential and Proprietary.
Use IAM (oauth, SAML)

150. ©2017 Lacework, Inc. Confidential and Proprietary.
3 Factors

151. ©2017 Lacework, Inc. Confidential and Proprietary.
Account password

152. ©2017 Lacework, Inc. Confidential and Proprietary.
Temporary password

153. ©2017 Lacework, Inc. Confidential and Proprietary.
And keys.

154. ©2017 Lacework, Inc. Confidential and Proprietary.
Log ALL logins.

155. ©2017 Lacework, Inc. Confidential and Proprietary.
Failures and Successes

156. ©2017 Lacework, Inc. Confidential and Proprietary.
Avoid service accounts logging in.

157. ©2017 Lacework, Inc. Confidential and Proprietary.
Yes no login as say...

158. ©2017 Lacework, Inc. Confidential and Proprietary.
ubuntu

159. ©2017 Lacework, Inc. Confidential and Proprietary.
coreos

160. ©2017 Lacework, Inc. Confidential and Proprietary.
admin

161. ©2017 Lacework, Inc. Confidential and Proprietary.
Or...root !!!!

162. ©2017 Lacework, Inc. Confidential and Proprietary.
Where possible limit users from
installing apps.

163. ©2017 Lacework, Inc. Confidential and Proprietary.
Immunitable images.

164. ©2017 Lacework, Inc. Confidential and Proprietary.
Use the orchestration. That is what
its for.

165. ©2017 Lacework, Inc. Confidential and Proprietary.
Understand the app behaviors.

166. ©2017 Lacework, Inc. Confidential and Proprietary.
Both to from and to the Internet.

167. ©2017 Lacework, Inc. Confidential and Proprietary.
And laterally from application to
application.

168. ©2017 Lacework, Inc. Confidential and Proprietary.
Within your “network”

169. ©2017 Lacework, Inc. Confidential and Proprietary.
And from container to container.

170. ©2017 Lacework, Inc. Confidential and Proprietary.
Secure the Data.8

171. ©2017 Lacework, Inc. Confidential and Proprietary.
Encrypt it.

172. ©2017 Lacework, Inc. Confidential and Proprietary.
ALL OF IT.

173. ©2017 Lacework, Inc. Confidential and Proprietary.
Its likely someone will find value in
your data

174. ©2017 Lacework, Inc. Confidential and Proprietary.
Regardless of what you think.

175. ©2017 Lacework, Inc. Confidential and Proprietary.
Keys are critical.

176. ©2017 Lacework, Inc. Confidential and Proprietary.
Look into vaults.

177. ©2017 Lacework, Inc. Confidential and Proprietary.
Rotate.

178. ©2017 Lacework, Inc. Confidential and Proprietary.
Ephemeral keys

179. ©2017 Lacework, Inc. Confidential and Proprietary.
Layer 8 : People9

180. ©2017 Lacework, Inc. Confidential and Proprietary.
“DevSecOps”

181. ©2017 Lacework, Inc. Confidential and Proprietary.
It’s just a made up word.

182. ©2017 Lacework, Inc. Confidential and Proprietary.
Establish communication channel
from/to devops and security.

183. ©2017 Lacework, Inc. Confidential and Proprietary.
#Slack works.

184. ©2017 Lacework, Inc. Confidential and Proprietary.
Alert on criticals : PagerDuty or ?

185. ©2017 Lacework, Inc. Confidential and Proprietary.
Log criticals and below in #channel

186. ©2017 Lacework, Inc. Confidential and Proprietary.
Email still works too.

187. ©2017 Lacework, Inc. Confidential and Proprietary.
Retrospectives on alerts.

188. ©2017 Lacework, Inc. Confidential and Proprietary.
Get good at triage.

189. ©2017 Lacework, Inc. Confidential and Proprietary.
A great security product/system will
help bridge gaps

190. ©2017 Lacework, Inc. Confidential and Proprietary.
from developers to security

191. ©2017 Lacework, Inc. Confidential and Proprietary.
from security to developers.

192. ©2017 Lacework, Inc. Confidential and Proprietary.
within or across teams.

193. ©2017 Lacework, Inc. Confidential and Proprietary.
Best practices.10

194. ©2017 Lacework, Inc. Confidential and Proprietary.
There is no time continuum in
security.

195. ©2017 Lacework, Inc. Confidential and Proprietary.
It does not stop or start.

196. ©2017 Lacework, Inc. Confidential and Proprietary.
It is just part of the system

197. ©2017 Lacework, Inc. Confidential and Proprietary.
And the system needs testing.

198. ©2017 Lacework, Inc. Confidential and Proprietary.
Pen testing.

199. ©2017 Lacework, Inc. Confidential and Proprietary.
Vulnerability testing

200. ©2017 Lacework, Inc. Confidential and Proprietary.
It’s not as scary as it sounds.

201. ©2017 Lacework, Inc. Confidential and Proprietary.
War game with dev.

202. ©2017 Lacework, Inc. Confidential and Proprietary.
Think evil.

203. ©2017 Lacework, Inc. Confidential and Proprietary.
What if I had privileged access to ….

204. ©2017 Lacework, Inc. Confidential and Proprietary.
Think about.

205. ©2017 Lacework, Inc. Confidential and Proprietary.
Data exfil.

206. ©2017 Lacework, Inc. Confidential and Proprietary.
Data destruction.

207. ©2017 Lacework, Inc. Confidential and Proprietary.
Public disclosures.

208. ©2017 Lacework, Inc. Confidential and Proprietary.
Inadvertent configuration mistakes.

209. ©2017 Lacework, Inc. Confidential and Proprietary.
Compliance failures.

210. ©2017 Lacework, Inc. Confidential and Proprietary.
Low level bugs out of your control.

211. ©2017 Lacework, Inc. Confidential and Proprietary.
Ring0 happens.

212. ©2017 Lacework, Inc. Confidential and Proprietary.
Be prepared

213. ©2017 Lacework, Inc. Confidential and Proprietary.
For recovery

214. ©2017 Lacework, Inc. Confidential and Proprietary.
It’s not *if* the market will ask about
your security.

215. ©2017 Lacework, Inc. Confidential and Proprietary.
It’s *when*.

216. ©2017 Lacework, Inc. Confidential and Proprietary.
Have the answers before they ask.

217. ©2017 Lacework, Inc. Confidential and Proprietary.
But what about bugs in MY
applications?
11

218. ©2017 Lacework, Inc. Confidential and Proprietary.
Be responsible.

219. ©2017 Lacework, Inc. Confidential and Proprietary.
Follow responsible disclosures.

220. ©2017 Lacework, Inc. Confidential and Proprietary.
Answer security@yourdomain

221. ©2017 Lacework, Inc. Confidential and Proprietary.
Be friendly to bug hunters

222. ©2017 Lacework, Inc. Confidential and Proprietary.
Bug bounty not mandatory but look
into it.

223. ©2017 Lacework, Inc. Confidential and Proprietary.
Don’t be held hostage to hunters.

224. ©2017 Lacework, Inc. Confidential and Proprietary.
But be responsible.

225. ©2017 Lacework, Inc. Confidential and Proprietary.
They are saving your time, money,
and potentially losses.

226. ©2017 Lacework, Inc. Confidential and Proprietary.
Run your own internal bug program.

227. ©2017 Lacework, Inc. Confidential and Proprietary.
Hack a thons are great for this.

228. ©2017 Lacework, Inc. Confidential and Proprietary.
And finally….

229. ©2017 Lacework, Inc. Confidential and Proprietary.
Have fun.12

230. ©2017 Lacework, Inc. Confidential and Proprietary.
Be thankful.

231. ©2017 Lacework, Inc. Confidential and Proprietary.
You are designing the future state.

232. ©2017 Lacework, Inc. Confidential and Proprietary.
Starting over is a privilege.

233. ©2017 Lacework, Inc. Confidential and Proprietary.
Learn from past mistakes.

234. ©2017 Lacework, Inc. Confidential and Proprietary.
To determine the future.

235. ©2017 Lacework, Inc. Confidential and Proprietary.
Wait, bakers dozen!13

236. ©2017 Lacework, Inc. Confidential and Proprietary.
What do you feel is missing?

237. ©2017 Lacework, Inc. Confidential and Proprietary.
Add your comments here.

238. ©2017 Lacework, Inc. Confidential and Proprietary.
Share your experiences.

239. ©2017 Lacework, Inc. Confidential and Proprietary.
Give back to the community :)

240. ©2017 Lacework, Inc. Confidential and Proprietary.
Lacework : Let us run your security

241. ©2017 Lacework, Inc. Confidential and Proprietary.
Lacework : While you focus on your apps.

242. ©2017 Lacework, Inc. Confidential and Proprietary.
Dan Hubbard, Lacework

243. ©2017 Lacework, Inc. Confidential and Proprietary.
@dhubbard858

244. ©2017 Lacework, Inc. Confidential and Proprietary.
.end