Learning Objectives: - Learn how to secure your web applications - Learn how to configure AWS Shield and AWS WAF - Learn how to defend the most common Layer 7 attacks Distributed denial of service (DDoS) and other web attacks can affect your application’s availability, compromise its security, and consume excessive resources. AWS Shield and AWS Web Application Firewall (WAF) help secure your applications from these types of attacks. AWS Shield is a managed DDoS protection service that offers always-on detection and automatic inline mitigation to minimize application downtime and latency. AWS WAF is a web application firewall that helps protect your applications from common web exploits such as SQLi, XSS, and botnets. This introductory tech talk will provide you an overview and demonstration of these services.

1. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Jeffrey Lyon and Sundar Jayashekar
July 12, 2017
Secure your Web Applications with
AWS WAF & AWS Shield

2. What to expect from this session
Types of Threats AWS Shield AWS WAF DEMO
© 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.

3. Types of Threats
Bad BotsDDoS Application Attacks
Reflection
Layer 4 floods
Slowloris
SSL abuse
HTTP floods
Amplification
Content scrapers
Scanners & probes
Crawlers
SQL injection
Application exploits
Social
engineering
Sensitive data
exposureApplication
Layer
Network /
Transport
Layer
AWS Shield
© 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.

4. Benefits of AWS Shield
AWS Integration
DDoS protection without
infrastructure changes
Affordable
Don’t force unnecessary
trade-offs between cost and
availability
Flexible
Customize protections
for your applications
Always-On Detection
and Mitigation
Minimize impact on application
latency
© 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.

5. AWS Shield
Standard Protection Advanced Protection
Available to ALL AWS customers at
no additional cost
Paid service that provides additional
protections, features, and benefits
© 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.

6. AWS Shield Standard
Layer 3/4 protection
 Automatic detection & mitigation
 Protection from most common
attacks (SYN/UDP floods, reflection
attacks, etc.)
 Built into AWS services
Layer 7 protection
 AWS WAF for Layer 7 DDoS attack
mitigation
 Self-service & pay-as-you-go
Automatic protection against 96%
of Layer 3/4 attacks
Available globally on all internet-facing AWS services
© 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.

7. AWS Shield Advanced
Additional detection & monitoring
Protection against large DDoS attacks
Visibility into attack detection & mitigation
AWS WAF at no additional cost
24X7 DDoS response team
Cost protection (absorb DDoS scaling cost)
© 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.

8. AWS Shield Advanced
Application Load Balancer Classic Load Balancer Amazon CloudFront Amazon Route 53
Available on ...
 Northern Virginia (us-east-1)
 Oregon (us-west-2)
 Ireland (eu-west-1)
 Tokyo (ap-northeast-1)
In the following regions ...
© 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.

9. Types of Threats
Bad BotsDDoS Application Attacks
Reflection
Layer 4 floods
Slowloris
SSL abuse
HTTP floods
Amplification
Content scrapers
Scanners & probes
Crawlers
SQL injection
Application exploits
Social
engineering
Sensitive data
exposureApplication
Layer
Network /
Transport
Layer
AWS WAF
© 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.

10. What is AWS WAF
Web traffic filtering
with custom rules
Malicious request
blocking
Active monitoring
and tuning
© 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.

11. AWS WAF – Key Benefits
Fast Incidence
Response
Preconfigured
Protection
APIs + Flexible Rule
Language
Ease of Use
© 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.

12. How Does AWS WAF Protect You?
© 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.

13. How Does AWS WAF Protect You?
© 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.

14. How Does AWS WAF Protect You?
© 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.

15. HTTP floods (Rated-
based Rules) Scanners and probes
SQL injection
Bots and scrapers
IP reputation lists
Cross-site scripting
Common protections using AWS WAF today ..
© 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.

16. AWS WAF Demo-1
Whitelisting
good users
© 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.

17. Example: Whitelisting good users
Verify that a valid referrer is present
Host: www.example.com
User-Agent: Mozilla/5.0 (Macintosh; …
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referrer: http://www.example.com/
Connection: keep-alive
AWS
WAF
RAW request headers
CloudFront
Check: Header “Referrer”
Match Type: Contains
Match: “example.com”
Action: ALLOW
Rule
String match condition
Good users
© 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.

18. AWS WAF Demo-2
Virtual Patching
© 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.

19. Example: Apache Struts Vulnerability
© 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Virtual Patching: A security policy enforcement layer which
prevents the exploitation of a known vulnerability in the code.
For more details:
https://forums.aws.amazon.com/ann.jspa?annID=4489

20. AWS WAF Demo-3
Brute Force
on Login
© 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.

21. Example: Rate limit access to login page
© 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
String Match
condition on
URI
Protection from
Brute force login
attempts
Rate-based
Rule

22. Recap
• Layer 7 DDoS
• Bots and scrapers
• Application
vulnerabilities
• Brute Force attempts
• Whitelist users
With AWS
Shield and AWS
WAF we
showed you
how you can
protect your web
applications
against:
© 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.

23. What about OWASP Top 10 coverage?
© 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
We recently launched a Toolkit! Give it a try
https://aws.amazon.com/blogs/aws/prepare-for-the-
owasp-top-10-web-application-vulnerabilities-using-aws-
waf-and-our-new-white-paper/
Includes a easily deployable CloudFormation template
that writes the sample rules for you!
This is our call to action for you today.

24. Thank you!
© 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.