Customers using AWS benefit from over 1,800 security and compliance controls built into the AWS platform and operations. In this session, you will learn how to take advantage of the advanced security features of the AWS platform to gain the visibility, agility, and control needed to be more secure in the cloud than in legacy environments. We'll take a look at several reference architectures for common workloads and highlight the innovative ways customers are using AWS to manage security more efficiently. After attending this session, you will be familiar with the shared security responsibility model and how you can inherit controls from the rich compliance and accreditation programs maintained by AWS.

1. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Holly Willey - AWS Global Accounts Solutions
Architect
August 14, 2017
Security @ (Cloud) Scale

2. Agenda
• Built-in AWS controls you
inherit
• Framework to help you adopt
cloud security best practices
• AWS services to automate your
security at scale
• Incident response reference
architecture example

4. AWS Security Controls

5. AWS Security Controls
2,500+

6. I wish I was a Solid
State Drive in
someone else’s data
center…

7. AWS Security Controls

8. AWS Security Controls
AWS Foundation Services
Compute Storage Database Networking
AWS Global
Infrastructure Regions
Availability Zones
Edge Locations
Your own
accreditation
Your own
certifications
Your own
external auditsCustomerAWS
Customer scope
and effort is reduced
Better results
through focused
efforts
Built on AWS
consistent baseline
controls

9. Cloud Adoption Framework
• Helps you adapt
existing practices
or introduce new
practices for cloud
computing

10. The Security Journey to the Cloud
Security in the cloud is familiar.
Ability to perform actions faster, at a larger scale and lower
cost, does not invalidate well-established principles of
information security.

11. Cloud Adoption Framework
Security Perspective
5 Core Capabilities
Identity and Access Management
Detective Controls
Infrastructure Security
Data Protection
Incident Response

12. Scaling to >1 million users
RDS DB Instance
Active (Multi-AZ)
Availability Zone
ELB
Balancer
RDS DB Instance
Read Replica
RDS DB Instance
Read Replica
Web
Instance
Web
Instance
Web
Instance
Web
Instance
Amazon
Route 53
User
Amazon S3
Amazon
CloudFront
DynamoDB
Amazon SQS
ElastiCache
Worker
Instance
Worker
Instance
Amazon
CloudWatch
Internal App
Instance
Internal App
Instance Amazon SES
Lambda

13. Security already built in…
Security groups are
virtual firewalls
that control the
traffic for one or
more resources
AWS Identity and
Access Management
(IAM) securely
controls access to
AWS services and
resources for your
users.

14. Identity and Access Management
AWS
Organizations AWS Identity
and Access
Management
(IAM)
AWS Security Token
Service (AWS STS)

15. Detective Controls
AWS
CloudTrail
Amazon
CloudWatch
AWS Config
Amazon
Inspector
Amazon VPC
Flow Logs
Account Resources Network

16. Detective Controls – VPC Flow Logs
Excess Rejected
Packets Alarm
Threshold
triggered by
>100 over 15 mins

17. Detective Controls – VPC Flow Logs
Sum of
bytes
Top 10 Accepted &
Rejected Sources
-–

18. Infrastructure Security
AWS OpsWorks
AWS Shield
AWS WAF
Resources Network
AWS Trusted
Advisor
AWS Config
Rules

19. Infrastructure Security – AWS Config Rules
• Amazon CloudTrail should be enabled…
 Is it?
• All EBS volumes encrypted…
 Are they?
• All security groups should not have unrestricted access
to port 22.
 Do they?

20. Infrastructure Security – AWS Config Rules
Checks whether
attached EBS volumes
are encrypted.

21. Infrastructure Security – AWS Config Rules
Evaluation Results
Resource type: EC2 Volume
Config timeline: Volume ID
Compliance: Noncompliant

22. Data Protection
AWS CloudHSM AWS Key Management
Service (KMS)
AWS Certificate Manager
(ACM)

23. Data Protection – Encryption
Encryption In-Transit
SSL/TLS
VPN / IPSEC
SSH
Encryption At-Rest
Object
Database
Filesystem
Disk

24. Data Protection –
AWS Certificate Manager (ACM)
• Easily provision,
manage, and
deploy TLS
certificates
• Use with Amazon
Elastic Load
Balancer (ELB) or
Amazon CloudFront
distribution

25. Data Protection – AWS Certificate Manager
Request a
certificate
1. Add domain
names
2. Review &
request
3. Validation

26. Data Protection – AWS Key Management
Service (KMS)
Data key 1
S3 object EBS
volume
Amazon
Redshift
cluster
Data key 2 Data key 3 Data key 4
Custom
application
Customer Master Keys

27. Incident Response
Amazon
CloudWatch
monitoring
AWS Lambda
serverless compute

28. Incident Response – Amazon CloudWatch Events

29. Incident Response – Amazon CloudWatch Events

30. Incident Response – Amazon CloudWatch Events

31. Incident Response – Amazon CloudWatch Events

32. Incident Response – Amazon CloudWatch Events

33. Incident Response – Amazon CloudWatch Events

34. Incident Response – AWS Lambda Log
from __future__ import print_function
import json
def lambda_handler(event, context):
print(json.dumps(event, indent=2))

35. Incident Response – Amazon CloudWatch Events
name: arn:aws:cloudtrail:us-east-1:35041922:trail/Default
eventType: AwsApiCall
eventName: StopLogging
userName: intern-bob

36. Incident Response – AWS Lambda Respond
cloudtrail = boto3.client('cloudtrail')
trail_arn =
event["detail"]["requestParameters"]["name
"]
ct_response = cloudtrail.start_logging(
Name = trail_arn
)

37. Incident Response – AWS Lambda Notify
sns_topic = "arn:aws:sns:us-east-1:123459227412:reporter-topic"
subject = 'EVENT: ' + event["detail"]["eventName"]
message = "What happened? " + event["detail"]["eventName"] + "n"
"What service? " + event["detail"]["eventSource"] + "n"
"Where? " + event["detail"]["awsRegion"] + "n"
"When? " + event["detail"]["eventTime"] + "n"
"Who? " + str(json.dumps(event["detail"]["userIdentity"], indent=2))
sns = boto3.client('sns')
sns_response = sns.publish(
TopicArn = sns_topic,
Message = message,
Subject = subject,
MessageStructure = 'string'
)

38. Incident Response – Amazon SNS Notification
What happened? StopLogging
What service? cloudtrail.amazonaws.com
Where? us-east-1
When? 2016-04-03T17:00:52Z
Who? jdulac
Log output from Lambda function

39. Incident Response – Complete

40. Scaling to >1 million users
RDS DB Instance
Active (Multi-AZ)
Availability Zone
ELB
Balancer
RDS DB Instance
Read Replica
RDS DB Instance
Read Replica
Web
Instance
Web
Instance
Web
Instance
Web
Instance
Amazon
Route 53
User
Amazon S3
Amazon
CloudFront
DynamoDB
Amazon SQS
ElastiCache
Worker
Instance
Worker
Instance
Amazon
CloudWatch
Internal App
Instance
Internal App
Instance Amazon SES
Lambda

41. Scaling to >1 million users
RDS DB Instance
Active (Multi-AZ)
Availability Zone
ELB
Balancer
RDS DB Instance
Read Replica
RDS DB Instance
Read Replica
Web
Instance
Web
Instance
Web
Instance
Web
Instance
Amazon
Route 53
User
Amazon S3
Amazon
CloudFront
DynamoDB
Amazon SQS
ElastiCache
Worker
Instance
Worker
Instance
Amazon
CloudWatch
Internal App
Instance
Internal App
Instance Amazon SES
Lambda
AWS
WAF
AWS
Shield
AWS
Organizations
AWS
CloudTrail
AWS
Config
VPC Flow Logs
Amazon
Inspector
AWS
OpsWorks

42. Deploy faster worldwide
16 Regions – 44 Availability Zones – 77 Edge Locations

43. AWS Marketplace Security Partners
Infrastructure
Security
Logging &
Monitoring
Identity & Access
Control
Configuration &
Vulnerability Analysis
Data Protection

44. Summary
o Integrated security & compliance
o Global resilience, visibility, & control
o Maintain your privacy & data ownership
o Agility through security automation
o Security innovation at scale
o Broad security partner & marketplace solutions

45. Q&A

46. Thank you!