by Steve Laino, GRC Consultant, AWS After AWS IAM and detective controls, the afternoon at AWS Security Week turns to infrastructure security, which means tuning AWS service configurations, AMI composition, and hardening other digital assets that will be deployed. You will learn how to define networking architecture (VPCs, subnets, security groups); how to develop hardened AMIs based on your requirements; the importance of defining Internet ingress and egress flows; and how to determine vulnerability management and operational maintenance cadence.

1. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved
Pop-up Loft
CAF Infrastructure Security: Your minimum security baseline
Steven Laino, CISSP / ISSAP, CCSP, CISM
Global Security Architect
Professional Services | Global Security, Risk & Compliance

2. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved
Infrastructure Security
• Least Privilege
• Infrastructure Security
• Virtual Private Cloud (VPC)
• AWS Shield / WAF
• Connectivity
• Quickstart templates
• Endpoint Security
• AMI Build
• Inspector
• EC2 Systems Manager (SSM)

3. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved
Least privilege
• Only the permissions required to perform the function
• Apply at various layers (App, Endpoint, Infra)
• User accounts
– Only give admin if required
• Security groups/NACLS
– Only allow ports that are necessary to the function
– Only allow connections that have a business need
• EC2 instances
– Only run services necessary
– Do not run more than one function/service

4. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved
Virtual Private Cloud (VPC)
Boundary Defense
• Control inbound and
outbound access to VPC,
instances and subnets
• Route Tables
• Network Access Control List
• Security Groups

5. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved
Security Groups / Network ACL Comparison
Security Group Network ACL
Operates at the instance level Operates at the subnet level
Supports allow rules only Supports allow rules and deny rules
Stateful: Return traffic is automatically
allowed, regardless of any rules
Stateless: Return traffic must be explicitly
allowed by rules
We evaluate all rules before deciding whether
to allow traffic
We process rules in number order when
deciding whether to allow traffic
Applies to an instance only if the security
group is specified
Automatically applies to all instances in the
subnets

6. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved
VPC Connectivity
• Internet Gateway
• Nat Gateway
• VPN
• Direct Connect
• VPC peering

7. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved
Defense in Depth
users
Applicatio
nservers
Private subnet
security
group
Public subnet
ELB IPS/IDS
Private subnet
ELB
security group
WAF
Private subnet
ELB
security group security group
ELB

8. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved
Quickstart Templates
• NIST 800-53
• PCI / HIPAA
• Deploy in a few minutes
• Best practices implemented
• Great starting point
• Free
• https://aws.amazon.com/qui
ckstart/

9. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved
Egress Control
Controlling traffic flows
• In addition to Security Groups,
NACLs & Routes
• VPC endpoints
• NAT gateways
• Inline Gateways
• DLP
• IDS
• App Filtering
• Host Tools
• DLP
• IDS
• FIM

10. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved
• VPC Endpoint: Gateway
• Gateway
– Access supported AWS
services without going to
internet
• Amazon S3
• DynamoDB

11. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved
VPC Endpoint: Interface
PrivateLink
• Access AWS & Partner
services without going to
Internet
• Create private endpoints for
services you provide
• Marketplace has SaaS
products available that use
PrivateLink

12. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved
Network Address Translation (NAT)
• 2 types: Gateway / Instance
• Allows Instances on private
subnets to communicate out
to the internet

13. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved
Elastic Load Balancers (ELB)
Feature ALB NLB CLB
Protocols HTTP, HTTPS TCP
TCP, SSL,
HTTP, HTTPS
Health Checks
✔ ✔ ✔
Load Balancing multiple ports ✔ ✔
Path-Based Routing ✔
Cross-zone load balancing ✔ ✔
SSL offloading ✔ ✔
Server Name Indication (SNI) ✔
Back-end server encryption ✔ ✔
• Application LB
– Layer 7
– SSL
• Network LB
– Layer 4 (TCP)
– Ultra low latency
• Classic LB
– Layer 4/7
– Only for EC2 Classic
– Not recommended

14. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved
Certificate Manager
• Protect & Secure Websites
• Secure Key Management
• Managed Cert Renewal
• No Cost

15. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved
Web Application Firewall (WAF)
• AWS Managed rules
• Create your own rules
• AWS marketplace rulesets
• Blacklist / Whitelist
• Monitor mode
• Layer 7 DDoS Protection

16. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved
AWS Shield
Managed DDoS Protection
• Shield Standard for All
• Protect from common attack
– Layer 3 & 4
– SYN/ACK
– UDP Flood
– Reflection
• Add WAF for Layer 7
• Shield Advanced ($)
– Sophisticated attacks
– Access to DDoS Team
– Cost protection Amazon
Route 53
CloudFront
users
security group (BuildABeer-SG-1)
Public subnet
servers
Private subnet
ELB

17. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved
Separation of services
Amazon
Route 53
CloudFront
security group
Public subnet
servers
Private subnet
ELB
www.foo.commail.foo.com
security group
Public subnet
Mail servers
Private subnet
ELB
security group
Public subnet
Web servers
Private subnet
ELB
mail.foo.com
www.foo.com

18. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved
AMI Factory
• Create secure baseline
• Monitor compliance
• Scan for vulnerabilities
• Remediate & Update
• Inspector, Config & SSM

19. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved
Vulnerability Management
Inspector
• Scan AMI as part of build
– CVE
– Configuration
• Scan / Patch Frequently
• Use with SSM to automate
patching
• Integrates with CI/CD Tools
• CVSS Scoring

20. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved
Amazon EC2 Systems Manager
• A set of capabilities that...
• ...enable automated configuration...
• ...and ongoing management of systems at scale...
• ...across all of your Windows and Linux workloads...
• ...running in Amazon EC2 or on-premises…
• ...at no charge; only pay for AWS resources you manage

21. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved
Amazon EC2 Systems Manager – Components
Run Command State Manager Inventory Maintenance
Window
Patch Manager Automation Parameter Store

22. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved
Remotely and securely manage servers or virtual machines at
scale running in your data center or in AWS
§ Automate common administrative tasks
§ Execute commands across multiple instances simultaneously
§ Support for AWS and on-premises infrastructure
§ Granular permissions to control access through AWS Identity &
Access Management
§ Logging using AWS CloudTrail
Run Command: Overview

23. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved
Provides visibility into the software catalogue and configuration
for your Amazon EC2 instances and on-premises servers
§ Gather detail on a variety of attributes, such as:
– Installed applications & OS details
– AWS components and agents
– Network configuration
§ Inventory attributes are stored in AWS Config for auditing
§ Assess compliance of configurations using AWS Config Rules
Inventory: Overview

24. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved
Provides secure storage for configuration data & secrets
• Store configuration data and secure strings in hierarchies and track
versions.
• Control and audit access at granular levels.
• Reference parameters across AWS services such as Amazon EC2,
Amazon EC2 Container Service, AWS Lambda, AWS
CloudFormation
Parameter Store: Overview

25. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved
Define and maintain consistent configuration of operating
systems and applications running in your data center or in AWS
§ Control configuration details such as anti-virus settings, iptables, etc.
§ Define your own schedules for deployment reviews
§ Compare actual deployments against specified configuration policy
§ State Manager reapplies policies if state drift is detected
§ Query State Manager to view status of deployments
State Manager: Overview

26. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved
Automated tool that helps you simplify your Windows operating
system patching process
§ Select the patches you want to deploy
§ Control timing for patch roll-outs and instance reboots
§ Define auto-approval rules for patches
§ Ability to black-list or white-list specific patches
§ Schedule the automatic roll out through maintenance windows
Patch Manager: Overview

27. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved
Summary
• Ingress filtering capability: use VPC design in combination with security groups and NACLs to
establish boundaries
• Egress filtering capability: use Security Groups, NACLs, NAT gateways, route tables and VPC
endpoints
• DDoS mitigation capability use: Cloudfront (Shield) & Route 53 to mitigate layer 3 and 4 attacks
• Vulnerability & Patch management capability: use Inspector and SSM
• Use SSM for:
– Configuration and patch compliance
– Secure privileged access to instances
– Automated patch management
– Software inventory & licensing compliance
– Secrets vaulting

28. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved
Thank You!

29. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved
Further Reading
• https://aws.amazon.com/blogs/devops/how-to-create-an-ami-builder-with-aws-codebuild-and-
hashicorp-packer/
• https://d0.awsstatic.com/aws-answers/AWS_Securing_EC2_Instances.pdf
• https://aws.amazon.com/ec2/systems-manager/

30. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved
Pop-up Loft
aws.amazon.com/activate
Everything and Anything Startups
Need to Get Started on AWS