The session will focus on the newly-launched security tool Hammer, which Dow Jones developed after identifying a security vulnerability internally. Users will learn more about Hammer and how it solves certain security configuration issues in the AWS cloud. The team behind the development of Hammer will showcase real-world examples of the tool identifying, analyzing and remediating issues, all as part of Dow Jones' commitment to helping everyone in the community as they make the jump to the cloud.

1. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
AWS re:INVENT
Dow Jones
H o w D o w J o n e s I d e n t i f i e s , A n a l y z e s , a n d R e m e d i a t e s S e c u r i t y I s s u e s
w i t h H a m m e r
S I D 3 5 0
N o v e m b e r 2 7 , 2 0 1 7

2. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Introduction
Ramin Beheshti
Group chief product and technology
officer
Pranav Patel
Security architect

3. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Cloud migration journey
● Agile
● Success story out of migration
● “Lift & Shift” applications
● Cost management
● “Fail forward fast...”
● “Act now, apologize later….”
● “Move Fast Break Things….”
https://memegenerator.net/instance/80795081

4. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Security…???
• Legacy cloud (....already?)
• Traditional security tools do not measure up
• Multi-Account visibility and controls
• Shared Responsibility Model
• Change in Landscape
“While moving fast and breaking things,
We forget to fix things!!!”
https://memegenerator.net/instance/80794879

5. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Exposures
• Vulnerability research tools
• Data dump sites
• Bots

6. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Initial journey
• Traditional model to
replicate Data Center
• Centralized devops and
security team

7. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Multi-account sprawl

8. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Multi-account sprawl
• Lack of visibility
• Scalability
• “Someone is looking into it…”

9. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Why…?
• Change of landscape
• Need to automate
• Challenges with traditional
security tool

10. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Multi-account growth: Ideal state

11. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Security: Defense-in-depth
Detective Controls
Reactive Controls
Proactive Controls

12. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Our solution
• Automate
• Scalable
• Self-service
• Auditable

13. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Hammer… why?
• Cloud Infrastructure visibility
• Easily pinpoint MY product’s security issues
• Tailored reporting, save analysis time
• “Auto-fix” misconfigurations with ability to rollback

14. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Consumer
• Multi-account customers
• Decentralized development organizations
• Multiple business units

15. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Hammer lifecycle
Identify
AnalyzeRemediate
Report

16. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Architecture

17. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Hammer – how does it work?

18. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Hammer—“auto-fix”

19. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Types of issues and remediation
❏ Business Critical:
Fix Now
❏ Report Now:
Schedule Fix
❏ Known Risk:
❏ Risk Sign-off

20. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Use-case 1: S3 buckets
● Audit against the Public ACLs
● Analyze the tags
● Report the issue
● Auto-Fix public ACLs

21. Demo
© 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.

22. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Use-case 2: Overexposed instances
● Audit against open ingress security groups and
instances with public IPs, or placed in public subnet
● Analyze the instance tags and meta-data
● Report the issue
● Auto-fix security group rules

23. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.

24. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Portfolio: Hammer services
Services Functionality Identification Analysis &
Reporting
Remediation
IAM
Weak IAM—IAM key rotations, enforce strong
password policy
x x x
Storage
Publicly accessible or misconfigured S3 bucket x x x
Compute
Overexposed EC2 instances that are attached to
over-exposed security groups
x x x
Network
Open ingress and egress security groups
Ex: Database ports, remote administration, and so on
x x x
Logging
AWS CloudTrail enabled x x Future release
App
Slated for future release Future release Future release Future release
Database
TBD Future release Future release Future release

25. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Open collaboration
• To be decided…

26. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Thank you!