This document summarizes a presentation about security automation improvements that can be made using Amazon CloudWatch Events and AWS Config Rules. It discusses five examples of automation: automatic CloudTrail remediation, CloudFormation template auditing, AWS CIS Foundation Framework account assessment, auto MFA for IAM users, and automatic isolation of "tainted" servers. Code examples and demonstrations are provided for each automation example. Other security automation tools and resources are also listed.

1. © 2016, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Henrik Johansson – Security Solutions Architect
12/01/16
5 Security Automation Improvements You
Can Make by Using Amazon CloudWatch
Events and AWS Config Rules
SAC401

2. What to expect from the session
Bonus!
Why security automation
Tooling
The anatomy of automation
Demo & code 5 x Automation
Other resources

3. What to expect from the session
Bonus!
Why security automation
Tooling
The anatomy of automation
Demo & code 5 x Automation
Other resources
5 x Automation
• Automatic CloudTrail remediation
• CloudFormation template audit
• AWS CIS Foundation Framework
account assessment
• Auto MFA for IAM
• The tainted server – Auto isolation

4. Bonus

5. Bonus
Code available for download
as Open Source on GitHub at:
http://github.com/awslabs/aws-security-automation
https://github.com/awslabs/aws-security-benchmark

6. Why security automation
Reduce risk of human error

7. Why security automation
Reduce risk of human error
- Automation is effective

8. Why security automation
Reduce risk of human error
- Automation is effective
- Automation is reliable

9. Why security automation
Reduce risk of human error
- Automation is effective
- Automation is reliable
- Automation is scalable

10. Why security automation
Reduce risk of human error
- Automation is effective
- Automation is reliable
- Automation is scalable
Don’t worry…we still need humans

11. Why security automation
Reduce risk of human error
- Automation is effective
- Automation is reliable
- Automation is scalable
Don’t worry…we still need humans

12. Why security automation
High pace of innovation is great

13. Why security automation
We also want to have high pace of:
Detection
Alerting
Remediation
Countermeasures
Forensics

14. AWS Tooling
Execution
• Lambda
Tracking
• AWS Config Rules
• Amazon CloudWatch Events
• AWS CloudTrail
• AWS Inspector
Track/Log
• Amazon CloudWatch Logs
• Amazon DynamoDB
Alert
• SNS
Third party Open Source

15. The anatomy of security automationMode
Section Actions
Initiate
React Config Rules / CloudWatch Events / Log Parsing
Trigger Lambda
Learn Lambda / CloudWatch Logs
Execution
Priority Action Restart service, delete user, etc.
Forensics Discover: Who/where/when, allowed to execute?
Countermeasure Disable access keys, isolate instance, etc.
Alert Text/Page, email, ticket system
Logging Database, ticket system, encrypt data?

16. Automatic CloudTrail Remediation
Solves:
- Verify that CloudTrail is running.
- Prevent repeated and future attempts to disable CloudTrail
Services used:
Lambda, CloudTrail, CloudWatch Events

17. Demo

18. Code highlights

19. Code highlights – Extract event info

20. Code highlights – Execution order
#1

21. Code highlights – Forensics

22. Code highlights – Countermeasure

23. Code highlights – Countermeasure

24. Code review

25. CloudFormation template audit
Solves:
- Users deploying infrastructure that do not conform to
security policy
- Reduce risk from unapproved changes to templates
Services used:
CodePipeline, CloudWatch Events, Lambda

26. Code highlights

27. Code highlights - CodePipeline

28. Code highlights - Flow

29. Code highlights – Rules

30. Code highlights – The rules
'rule': "AllowHttp",
'category': "SecurityGroup",
'ruletype': "regex",
'active': "Y",
'riskvalue': "3",
'ruledata':
"^.*Ingress.*[fF]rom[pP]ort.s*:s*u?.(80)"

31. Code highlights – The rules
'rule': "SSHOpenToWorld",
'category': "SecurityGroup",
'ruletype': "regex",
'active': "Y",
'riskvalue' ”7",
'ruledata':
"^.*Ingress.*(([fF]rom[pP]ort|[tT]o[pP]ort)
.s*:s*u?.(22).*[cC]idr[iI]p.s*:s*u?.((0
.){3}0/0)|[cC]idr[iI]p.s*:s*u?.((0.){3
}0/0).*([fF]rom[pP]ort|[tT]o[pP]ort).s*:
s*u?.(22))"

32. Code highlights - Evaluating

33. Code highlights - Evaluating

34. Code highlight – Risk and next step
if risk < 5:
put_job_success(job_id, 'Job succesful, minimal
or no risk detected.')
elif 5 <= risk < 10:
put_job_success(job_id, 'Job succesful, medium
risk detected, manual approval needed.')
elif risk >= 10:
put_job_failure(job_id, 'Function exception:
Failed filters '+str(failedRules))

35. Code review

36. AWS CIS Foundation Framework account
assessment
Solves:
- Validate AWS account against security best practices
- Integrate with AWS Config
- Create report for easy and secure consumption
Services used:
Lambda, Config Rules
References:
AWS CIS Foundation Framework validation

37. Demo

38. Code highlights

39. Code highlight - Options

40. Code highlight - Options

41. Code highlight - Control structure

42. Code highlight - Control structure

43. Code highlight - Control structure

44. Code highlight - Control structure

45. Code highlight – Result - Config

46. Code highlight – Result - Config

47. Code highlight – Result – Config - Annotation

48. Code highlight – Result – HTML Report

49. Code highlight – Result – S3 Pre-Signed URL

50. Code highlight – Result – S3 Pre-Signed URL

51. Code review

52. Auto MFA for IAM
Solves:
- Automatic creation and assignment of virtual MFA for new IAM
users.
- Removes time consuming tasks for single and bulk operations
- No requirements of user interaction or giving permissions using IAM
policy for self service
Services used:
CloudWatch Events, Lambda and IAM

53. Demo

54. Code highlights

55. Code highlight – Priority action

56. Code highlight – Create virtual MFA

57. Code highlight – Enable MFA

58. Code highlight – Enable MFA

59. Code highlight – Calculate tokens

60. Code highlight – Assign MFA

61. Code highlight – Assign MFA

62. Code highlight – Encrypt string

63. Code review

64. The tainted server – Auto isolation
Solves:
• Enforces immutable infrastructure
• Automatically isolate instances for further forensics upon events like
local SSH logons or increase Deny discovered in VPC flow logs
Services used:
CloudWatch Events, Config Rules, Lambda, VPC Flow logs and
discovery trigger

65. Demo

66. Code highlights

67. Code highlight – Individual instances

68. Code highlight – Get tainted

69. Code highlight – Get tainted

70. Code highlight – Get tainted

71. Code highlight – Get tainted

72. Code highlight – Detach Auto Scaling Group

73. Code highlight – Detach Auto Scaling Group

74. Code highlight – Identify security group

75. Code highlight – Identify security group

76. Code highlight – Identify security group

77. Code highlight – Identify security group

78. Code review

79. Other resources / Open Source
Some of the projects out there:
• ThreatResponse.cloud https://threatresponse.cloud
• Cloud Custodian https://github.com/capitalone/cloud-custodian
• Security Monkey https://github.com/Netflix/security_monkey
• FIDO https://github.com/Netflix/Fido
• CloudSploit https://github.com/cloudsploit
And many more…

80. Bonus
Code available for download
as Open Source on GitHub at:
http://github.com/awslabs/aws-security-automation
https://github.com/awslabs/aws-security-benchmark

81. Related Sessions
SEC301 - Audit Your AWS Account Against Industry Best
Practices: The CIS AWS Benchmarks
SEC311 - How to Automate Policy Validation
SEC313 - Automating Security Event Response, from Idea to Code
to Execution
SAC315 - Scaling Security Operations and Automating
Governance: Which AWS Services Should I Use?
SEC401 - Automated Formal Reasoning About AWS Systems

82. Thank you!

83. Remember to complete
your evaluations!