AWS re:Invent Comes to London 2019 - Security Strategy, Tim Rains

© 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.
COMESTOLONDON
Cybersecurity Strategies
Tim Rains
EMEA Regional Leader Security & Compliance
Worldwide Public Sector
Amazon Web Services

COMESTOLONDON

COMESTOLONDON
Ingredients for a Successful Cybersecurity Strategy
• Business objective alignment
• Senior executive and Board support
• Cybersecurity Vision, Mission, Imperatives shared with stakeholders
• High value assets (Crown Jewels) are defined, executive buy-in
• Principles to help govern risk appetite and approach, executive buy-in
• Realistic view of current cybersecurity capabilities and technical talent
• Compliance program and control framework alignment
• Effective relationship with IT
• Security culture where everyone participates, executives evangelize

COMESTOLONDON
Critical Ingredient: How Initial Compromise Happens
1. Unpatched vulnerabilities
2. Security misconfigurations
3. Weak, leaked, stolen passwords
4. Social engineering
5. Insider threat
Preventing, detecting and responding to initial compromise minimizes
damage and costs to the organization

COMESTOLONDON
Critical Ingredient: Underlying Assumptions
• Assume breach: the organization will be compromised
• Gives CISO permission to invest in protection, detection, and response capabilities
• Investing only in protection capabilities enables attackers to:
• Persist indefinitely after initial compromise
• More easily attack the organization’s partners and customers
• Maximize their ROI and damage to the organization, its partners and customers
• The C-suite has a “shared destiny” with the CISO
• The CISO’s success/failure impacts organization’s global brand in a
unique way

COMESTOLONDON
Popular Cybersecurity Strategies

COMESTOLONDON
Protect & Recover Strategy
• Underlying assumption: the organization has adequate protection,
so it doesn’t need to invest in detection and response capabilities
• Focus: protection and recovery processes and technology
• Characterized by: investments primarily in perimeter and network
protection, backup and recovery

COMESTOLONDON
Protect & Recover Strategy Performance Report Card
• Potentially gives more time to patch
• Users bring exploits through defenses
Unpatched
vulnerabilities
• Can make it harder to find and exploit
Security
misconfigurations
• Does not mitigate
Weak, leaked,
stolen passwords
• Does not mitigateSocial engineering
• Does not mitigateInsider threat
Good coverage
(2pts)
Partial coverage
(1pt)
Little or no
coverage (0pts)
Cybersecurity
fundamentals
Score:
2/10

COMESTOLONDON
Endpoint Protection
Strategy
• Underlying assumption:
protecting endpoints and devices
is an effective proxy for
protecting the organization’s
data
• Focus: protecting endpoints and
devices that process, store and
transmit data
• Characterized by: investments in
host based protection
technologies

COMESTOLONDON
Endpoint Protection Strategy Performance Report Card
• Well managed vulnerability management
program mitigates
Unpatched
vulnerabilities
program mitigates
Security
misconfigurations
• Can partially mitigate if secure/privileged access
workstations used (combined with ID strategy)
Weak, leaked,
stolen passwords
• Can partially mitigate by blocking malicious
URLs, files, USB, etc.Social engineering
• Can help mitigate unwitting insider mistakes
• Typically does not mitigate malicious insider
Insider threat
Good coverage
(2pts)
Partial coverage
(1pt)
Little or no
coverage (0pts)
Cybersecurity
fundamentals
Score:
7/10

COMESTOLONDON
Compliance as a
Security Strategy
• Underlying assumption:
meeting compliance
obligations is sufficient for
protecting the organization’s
data
• Focus: meeting organization’s
regulatory compliance
obligations such as PCI, HIPPA,
GDPR, etc.
• Characterized by: investments
in people, processes, and
technologies that help meet
compliance obligations

COMESTOLONDON
Compliance as a Security Strategy Performance Report Card
• Well managed vulnerability management program mitigates
• But only applies to scope of regulation
Unpatched
vulnerabilities
• But only applies to scope of regulation
Security
misconfigurations
• Can partially mitigate by enforcing complex password policy
Weak, leaked,
stolen passwords
• Can partially mitigate by requiring trainingSocial engineering
• Typically does not mitigateInsider threat
Good coverage
(2pts)
Partial coverage
(1pt)
Little or no
coverage (0pts)
Cybersecurity
fundamentals
Score:
5/10

COMESTOLONDON
Application-centric
Strategy
• Underlying assumption: protecting
applications that handle data protects
the organization’s data
• Focus: securing applications that
process, store and transmit data
security development lifecycles,
static/dynamic code analysis tools,
penetration testing, mobile
device/application management, bug
bounties

COMESTOLONDON
Application-centric Strategy Performance Report Card
• Security development practices help reduce vulns
Unpatched
vulnerabilities
• Security development & operations practices help reduce
vulns
Security
misconfigurations
• Can partially mitigate by supporting modern protocols and
MFA
Weak, leaked,
stolen passwords
• Can partially mitigate by designing apps that help users
make effective trust decisionsSocial engineering
• Can partially mitigate by designing apps that require limited
privileges, perform logging, designing environments with
just enough and just in time administration
Insider threat
Good coverage
(2pts)
Partial coverage
(1pt)
Little or no
coverage (0pts)
Cybersecurity
fundamentals
Score:
7/10

COMESTOLONDON
Identity-centric Strategy
• Underlying assumption: the
organization can better protect data
by better protecting the identities
used to access the data
• Focus: protecting the identities and
credentials used to access the
organization’s data and used to
administrate key systems
identity management technologies
and credential hygiene practices

COMESTOLONDON
Identity-centric Strategy Performance Report Card
Unpatched
vulnerabilities
Security
misconfigurations
• MFA and intelligence help mitigate risks
• Getting coverage across hybrid environment with legacy
apps much more challenging
Weak, leaked,
stolen passwords
• MFA and intelligence can mitigate in some scenarios by
making it harder for attackers to successfully get access to
data
Social engineering
• Can partially mitigate by making it harder for malicious or
unwitting insiders to steal or expose data
• Can help provide data for IR purposes
Insider threat
Good coverage
(2pts)
Partial coverage
(1pt)
Little or no
coverage (0pts)
Cybersecurity
fundamentals
Score:
3/10

COMESTOLONDON
Data-centric Strategy
• Underlying assumptions:
• Data, not the systems that process it, are the
high valued assets
• Data will move without the organization’s
approval or knowledge
• Data must be protected regardless of where
it is
• Data needs to be shared internally and with
authorized partners
• Some organizations assume the systems that
process data are compromised
• Focus: protect data wherever it is
transmitted, processed and
stored…forever
• Characterized by: investments in Data
Loss Prevention (DLP), encryption, key
management technologies, potentially
data classification

COMESTOLONDON
Data-centric Strategy Performance Report Card
• Can mitigate exploitation of vulnerabilities by making it
harder to access encrypted data post exploitation.
• Might not mitigate in all cases
Unpatched
vulnerabilities
• Can mitigate exploitation of vulnerabilities by making it
harder to access encrypted data post exploitation.
• Might not mitigate in all cases
Security
misconfigurations
• Unauthorized access to data using valid credentials typically
not mitigated using this strategy alone
Weak, leaked,
stolen passwords
• Can mitigate in some scenarios by making it harder for
attackers to successfully get access to dataSocial engineering
• Can partially mitigate by making it harder for malicious or
unwitting insiders to steal or expose dataInsider threat
Good coverage
(2pts)
Partial coverage
(1pt)
Little or no
coverage (0pts)
Cybersecurity
fundamentals
Score:
4/10

COMESTOLONDON
Security Clearances Strategy
• Underlying assumptions:
• End to end physical control of networked devices protects data
• Data center staff that have physical access to hardware also have access to data
• Therefore, only people with select citizenships and clearances can be permitted access to data centers
• A data residency requirement is an effective data protection control
• Focus: security assurance of hardware, periodic background checks of data center staff and administrators
• Characterized by: investments in people, processes, and technologies that help maintain physical security and
assurance, as well as confidence in the character of datacenter staff and administrators

COMESTOLONDON
Security Clearances Performance Report Card
• Physical security practices, security clearances and data
residency do not mitigate
• Requires a well managed vulnerability management program
Unpatched
vulnerabilities
• Requires a well managed vulnerability management program
Security
misconfigurations
• Not mitigated
Weak, leaked,
stolen passwords
• Require authorized personnel to take on-going training
• Does not fully mitigate non-malicious insider threatSocial engineering
• History has taught us this isn’t fully mitigated
• Does not fully mitigate malicious and non-malicious insider
threat
Insider threat
Good coverage
(2pts)
Partial coverage
(1pt)
Little or no
coverage (0pts)
Cybersecurity
fundamentals
Score:
2/10

COMESTOLONDON
Intrusion Kill
Chain Strategy

COMESTOLONDON
“Cyber kill-chain®”
Cyber kill-chain® is a registered trademark of Lockheed Martin
1 2 3 4 5 6 7RECON
WEAPON
DELIVER
EXPLOIT
INSTALL
C&C
ACT

COMESTOLONDON
Intrusion Kill Chain Strategy

COMESTOLONDON
Intrusion Kill Chain Strategy
• Underlying assumption: forcing attackers to be successful multiple
times during intrusion attempts helps identify protection gaps,
decreases detection and recovery times
• Focus: detecting, denying, disrupting, degrading, and deceiving
attackers in all seven phases of kill chain
• Characterized by: investments in numerous areas to cover the 7
phases of the intrusion kill chain

COMESTOLONDON
Intrusion Kill Chain Strategy Performance Report Card
program mitigates
Unpatched
vulnerabilities
program mitigates
Security
misconfigurations
• Can implement effective mitigations
Weak, leaked,
stolen passwords
• Can mitigate in some scenarios by making it
harder for attackers to be successful
Social engineering
• Can implement effective mitigationsInsider threat
Good coverage
(2pts)
Partial coverage
(1pt)
Little or no
coverage (0pts)
Cybersecurity
fundamentals
Score:
9/10

COMESTOLONDON
Modified Courses of Action Matrix
Intrusion Kill Chain Phase
Detect
Deny
Disrupt
Degrade
Deceive
Contain
Respond
Restore
Reconnaissance: pre-intrusion
Reconnaissance: post-intrusion
Weaponization
Delivery
Exploitation
Installation
Command and Control
Actions on Objectives

COMESTOLONDON
Phase:Reconnaissance:pre-intrusion
PhaseDescription:thisphaserepresentsthe work attackersdo to researchandselecttheirtargets,and
understandtheirtargets’digitalfootprints.
ControlObjectives:detect,deny, disrupt,degrade,deceive,contain,respond
Modified Courses of Action Example
Detect: to discover or discern the existence, presence, or fact of an intrusion into information systems
AWS Controls: Amazon GuardDuty, Amazon GuardDuty Partners, AWS WAF, WAF Managed Rules,
CloudWatch, CloudWatch Logs, CloudTrail and reporting tools such as Elastic Search, QuickSight, etc. in
addition to 3rd party tools such as Splunk, Trend Micro, Alertlogic, etc
Deny: to prevent the adversary from accessing and using critical information, systems, and services
AWS Controls: Amazon Virtual Private Cloud (VPC), AWS Identity and Access Management (IAM) + AWS
Organizations, AWS Certificate Manager + Transport Layer Security (TLS), Network infrastructure
solutions in the AWS Marketplace, AWS WAF, WAF Managed Rules, AWS Direct Connect, Systems
Manager Session Manager and Run Command

COMESTOLONDON
Measuring performance & effectiveness
of your cybersecurity investments

COMESTOLONDON
Measuring Performance & Effectiveness
• Perform intrusion reconstructions on successful, partially successful, and
failed intrusion attempts
• Key questions
• How far did attackers get with their intrusion kill chain before
detected?
• Was data exfiltration attempted/successful?
• What controls failed to protect and detect?
• Where did gaps in protection and detection controls contribute to
attacker success?
• Where did attackers and/or defenders get lucky?
• How long did it take for the attack to be detected?
• Did the SOC/CSOC get the data they needed to detect intrusion?
• Did the IR process work as designed?
• Did IT partner during the intrusion as planned?
• How did your vendor(s) help?

COMESTOLONDON
Measuring Performance & Effectiveness
• Intrusion reconstructions can be very helpful
• Identifies which controls work as advertised/expected
• Identifies which controls failed to perform as expected
• Identifies which control integrations worked/failed
• Can help confirm security controls/investment gap analysis
• Can help confirm you have the correct investment priorities
• Identifies people and processes that performed/underperformed
• Can help inform pen test/red team exercises
• Helpful data on control/capability efficacy
• Helpful data for vendor renewal discussions/negotiations
• Data can help inform governance, risk, and compliance, and build a
business case for appropriate changes

COMESTOLONDON
AWS Identity & Access
Management (IAM)
AWS Organizations
AWS Cognito
AWS Directory Service
AWS Single Sign-On
AWS CloudTrail
AWS Config
Amazon
CloudWatch
Amazon GuardDuty
VPC Flow Logs
AWS Security Hub
Amazon EC2
Systems Manager
AWS Shield
AWS Web Application
Firewall (WAF)
Amazon Inspector
Amazon Virtual Private
Cloud (VPC)
AWS Key Management
Service
AWS CloudHSM
Server/Client Side
Encryption
Amazon Macie
Certificate Manager
Secret Manager
AWS Config Rules
AWS Lambda
Identity
Detective
control
Infrastructure
security
Incident
response
Data
protection
Where to Start: Cloud Adoption Framework
https://d0.awsstatic.com/whitepapers/AWS_CAF_Security_Perspective.pdf

COMESTOLONDON
Resources
https://aws.amazon.com/security/
https://aws.amazon.com/compliance/
Cloud Adoption Framework, Security Perspective
https://d0.awsstatic.com/whitepapers/AWS_CAF_Security_Perspective.pdf
Well-Architected framework
https://aws.amazon.com/architecture/well-architected/

AWS re:Invent Comes to London 2019 - Security Strategy, Tim Rains

Recommended

Recommended

More Related Content

What's hot

What's hot (20)

Similar to AWS re:Invent Comes to London 2019 - Security Strategy, Tim Rains

Similar to AWS re:Invent Comes to London 2019 - Security Strategy, Tim Rains (20)

More from Amazon Web Services

More from Amazon Web Services (20)

AWS re:Invent Comes to London 2019 - Security Strategy, Tim Rains