by Zack Milem, Trend Micro DevOps can be coded quickly in the cloud, but it still needs to be secured. In this session, we will discuss how an automated security infrastructure can be constructed. Building from the ground up with API driven security controls, a Security Fabric in AWS can be the foundation to deliver a fast and secure environment in the cloud.

1. Building an Automated Security
Fabric in AWS
Zack Milem
Solutions Architect
Copyright 2017 Trend Micro Inc. 1

2. Problem

3. Are things
happening?

4. Is that bad?

5. Humans

6. Humans
Forgetful
Make mistakes
Analysis paralysis
Systems
Don’t tire
Consistent
Fast execution

7. P P P
People Process Products
Successful Security

8. Data
Successful Tools
in out
Orchestrate

9. Dev
Hey look, we built
something!
Ops Are things happening?
Sec Is that bad?

10. Are/is there?
Bugs
Sufficient capacity
Performance issues
Odd behaviours
Data losing integrity
Dev
Sec
Ops

11. Fabric

12. 1 min
Slow lane
Fast lane

13. 1 min
Is this bad?
Is this malicious?
and

14. 1 min
Aggregate information
1m, h, d, w, m
Trends

15. 1 min
Aggregate information
1m, h, d, w, m
Trends
Evidence of compliance
Configuration
Processes
Deployment data
Performance
Debug

16. 1 min
Aggregate Evidence Deployments
SecOps
AWS CloudTrail
AWS Config Rules
Amazon CloudWatch Logs
Amazon SNS
Amazon CloudWatch Events
Amazon Macie

17. In Action

19. 1 min
EC2 Instance
Security Group
Malware event
Was it cleaned/quarantined?
SNS => Lambda
Record incident response
S3 + CloudTrail

20. Copyright 2016 Trend Micro Inc.20 AWS Cloud
Availability Zone - 1 Availability Zone - 2
Auto Scaling
Instances Instances
Load Balancer
Region
Client
HTTP/HTTPS
Cloud
Deep Security
Users
ELB
Sending Security Events
AWS
Lambda
Amazon
SNS
AWS WAF
Forward Security Events to SNS
Invoking Lambda
Function from SNS
Change Security Group for the instance
Attack!!!
Quarantine
security group
Launch a new
instance
Security for
DevOps

21. Copyright 2016 Trend Micro Inc.21 AWS Cloud
Availability Zone - 1 Availability Zone - 2
Auto Scaling
Instances Instances
Load Balancer
Region
Client
HTTP/HTTPS
Cloud
Deep Security
Users
ELB
Sending Security Events
AWS
Lambda
Amazon
SNS
Attacks!!!
AWS WAF
Forward Security Events to SNS
Invoking Lambda Function from SNS
Register the IP
blocked by DSA
Integration.
Security as Code

22. Resiliency

23. Primary traffic flow
TCP:443 TCP:443 TCP:443 TCP:443

24. Primary traffic flow
HTTPSHTTPSSSHHTTPS
SQLi

25. Static build vs Dynamic (Chef, Puppet, Ansible)
Gartner: Move from “A Secure Network of Workloads” to “A Network of Secure Workloads”

27. 4. Destroy
1. Change
2. Test
3. Promote
[ Production ][ Production ]

28. Integrity Monitoring + Application Control

30. Resiliency

31. Anti-malware Intrusion
Prevention
Host
Firewall
Integrity
Monitoring
Log Inspection
Trend Micro
Deep Security
• Auto-detect instances and
rapidly protect them
• Full suite of security controls
delivered through a single
platform
• Host-based protection so
security isn’t a bottleneck
• Automate your security
response through open API’s
and AWS integration
Application
Control

32. Copyright 2015 Trend Micro Inc.32
Quick Start & Enterprise Accelerator
AWS Quick Start includes:
• Deployment guide
• CloudFormation template, including
plug and play sub-templates
• One-click set up and configuration
Launches, configures, and runs AWS compute, network, storage etc. + Deep Security
using AWS best practices for security and availability

33. Copyright 2015 Trend Micro Inc.33

34. Deep Security in AWS Reference Architecture
v Security Group
Configuration
v IAM Account
Configuration

35. Copyright 2015 Trend Micro Inc.35
Agent Automation Options
• Orchestration Tools – Chef, Puppet, Ansible, etc.
• CloudFormation templates
• AMI “Baking”
• API Integration
• Advanced Details > UserData Field
(New Instance or Launch Configuration)

37. trendmicro.com/aws
Zack_milem@trendmicro.com