Strengthening the security of federal networks, systems, and data is one of the most important challenges we face as a nation. The Office of Management and Budget (OMB) issued guidance that all federal agencies must establish information exchanges between their dashboards and the central federal dashboard. To assist in this requirement, we explore how agencies can implement a continuous diagnostics and mitigation (CDM) program using AWS. Topics include AWS services that map to CDM requirements; how to enforce compliance with standards; ways to provide visibility into current and actual states; how to centralize service data to build a dashboard; and how to create a chief information officer FISMA dashboard using AWS native services.

1. P U B L I C S E C T O R
S U M M I T
WASH INGTON, D C

2. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.P U B L I C S E C TO R
S U M M I T
Security & Identity: the Continuous
Diagnostic & Mitigation (CDM)
Journey on AWS
Evan Uhl
Director, Consulting Expert
CGI Federal
S e s s i o n I D : 2 9 9 9 3 7
Darren House
Sr. Solutions Architect
AWS

3. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.P U B L I C S E C TO R
S U M M I T
Agenda
Understand CDM and the drivers
Getting from requirements to
architectures
Show how to centralize sensor
data and visualize with an
agency dashboard on AWS
Asset
Management
What is on the
Network
Identity &
Access
Management
Who is on the
Network
Data Protection
Management
What is Happening
on the Network
Network
Security
Management
Protect Data on
the Network

4. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.P U B L I C S E C TO R
S U M M I T
Related breakouts
302902 - Continuous Diagnostics and Mitigation (CDM) at Cloud Scale:
How the U.S. Department of Energy Modernized Cyber Resiliency with
the Big Data Platform
Mark Burr
319028 - Aligning to the NIST Cybersecurity
Framework in the AWS
Michael South

5. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.P U B L I C S E C TO R
S U M M I T
Drivers

6. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.P U B L I C S E C TO R
S U M M I T
Drivers

7. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.P U B L I C S E C TO R
S U M M I T
OMB - M-19-02
• CFO Act Agencies must report FISMA CIO Metrics quarterly
• Non-CFO Act Agencies must update FISMA CIO Metrics semiannually
• CFO and non-CFO Act agencies shall establish the information
exchange with the Federal Dashboard
H.R.6443
Advancing Cybersecurity Diagnostics and Mitigation Act
S.3464
Advancing Cybersecurity Diagnostics and Mitigation Act
Drivers

8. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.P U B L I C S E C TO R
S U M M I T
Cyber attacks are the newest
arms race
• Attackers have unlimited resources and
budget
• Defenders have to effectively deploy
CDM to increase their Agency’s security
posture and provide a ROI
How do you improve your
security posture?
• Take a step back and look at the big
picture
• Be honest with the evaluation of your
security posture
Rethink CDM
Don’t think of it as a phased
approach anymore – DHS doesn’t

9. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.P U B L I C S E C TO R
S U M M I T
Attack vectors and exploit
methods are constantly changing
Limited visibility, tools, policies,
procedures, and speed to deploy
Cyber-Defenders are in high
demand and are limited in
numbers
What is the big picture?

10. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.P U B L I C S E C TO R
S U M M I T
How do we fix this?
Take a holistic approach to treating the
deficiencies = CDM
 Asset Management
 Identity and Access Management
 Network Security Management
 Data Protection Management
Every environment is different – one size doesn’t
fit all
Every level of the client should be considered
Assess what tools are in place and working for
the client
Don’t be scared to innovate
Supplement the stack where needed
Methodology to CDM Success

11. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.P U B L I C S E C TO R
S U M M I T
CGI and CDM
January 2017
Awarded Credential Management
Task Order
Identity & Access Management
Provided agencies with tools, sensors and services to
meet requirements for Trust | Behave | Cred
All 26 agencies relied on CGI for Identity & Access
Management
July 2018
Awarded Group C Task Order under
CDM DEFEND
Network Security + Data Protection Management
Identify and remediate deficiencies in Asset,
Identity, & Access Management

12. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.P U B L I C S E C TO R
S U M M I T
Architecture

13. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.P U B L I C S E C TO R
S U M M I T
But how can we get from:
Here  There?To 

14. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.P U B L I C S E C TO R
S U M M I T
Innovating on Behalf of our Customers
In 2018…
• Pace of innovation: 1800+ updates
• Meets pace of protection: 239 security updates

15. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.P U B L I C S E C TO R
S U M M I T
CDM Requirement AWS Services
Hardware Asset Management AWS Systems Manager, AWS Config
Software Asset Management AWS Systems Manager, AWS License Manager
Configuration Settings
Management
AWS Systems Manager, AWS Config
Vulnerability Management: Amazon Inspector, AWS Config, AWS CloudTrail, Amazon
GuardDuty, Amazon Macie
BOUND F
BOUND E
BOUND P
Amazon Virtual Private Cloud (Amazon VPC), AWS Shield,
AWS WAF, AWS Key Management Service (AWS KMS),
AWS CloudHSM, AWS Certificate Manager (AWS ACM)
3rd party attestations, SOC, FedRAMP, NIST 800-53
Manage Events Amazon CloudWatch, Amazon Inspector, Amazon
GuardDuty
Operate, Monitor, Improve Amazon CloudWatch, AWS Lambda, AWS Step Functions
Design and Build in Security AWS CodeBuild, AWS CodeCommit, AWS CodeDeploy

16. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.P U B L I C S E C TO R
S U M M I T
Common OR 1.2(3) - define desired and actual
state dependent on object context and the
scope of the capability’s attributes.
HWAM OR 1.1(2) - identify and track hardware
devices, manual or batch creation of Agency-
approved device data
SWAM OR and FR – identify, collect, and track
software products/inventory
Provide a unique for each software product
CSM OR and FR – Identify, collect, and keep
security configuration settings

17. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.P U B L I C S E C TO R
S U M M I T
Common OR 1.2(3) - define actual and desired
state of an object
HWAM OR and FR - identify and track
authorization status, unique identifiers, desired
state detection
SWAM OR and FR – identify, collect, and track
inventory
CSM OR and FR – Identify, collect, and keep
security configuration settings

18. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.P U B L I C S E C TO R
S U M M I T
CSM FR – Support a unique identifier (CCE) for
each configuration setting
VUL OR – detect/discover vulnerabilities that
have been identified by the government CVEs.
Explain clearly and simply how to correct the
vulnerability.
VUL FR – Provide complete coverage of the
CVEs identified by the National Vulnerability
Database (NVD)

19. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.P U B L I C S E C TO R
S U M M I T
MNGEVT IR OR 1-2 - Sharing and
communicating incident response about cyber
threat information to internal and external
organizations.
MNGEVT FR 1-1 - Initial analysis to determine
incident severity based on the types of events,
threat source, threat signatures, and impacted
systems.
Complex aggregation and correlation
algorithms using large volumes of stored data
in a timely manner to generate incident
reports.

20. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.P U B L I C S E C TO R
S U M M I T
Integration Story for CDM
• 2 Major Players in the IAM Space combined to
support part of a major Federal program
• 2 Big Players + 1 Standard (SCIM V2) =
Doesn’t work as expected or advertised
Now What?
• Researched the challenge
• Designed a solution that didn’t require the
vendors to “patch” (which we know wasn’t going
to happen)
• Adapt, improvise, overcome.

21. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.P U B L I C S E C TO R
S U M M I T
AWS
Lambda
Amazon CloudWatch
AWS CloudTrail
Scheduled
Event
AWS Config
AWS Systems
Manager
Amazon GuardDuty
Amazon Inspector
CIO Dashboard
Centralized
S3 Bucket
AWS Step
Functions
Lambda
Functions
Amazon
QuickSight

22. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.P U B L I C S E C TO R
S U M M I T
Service FedRAMP Moderate
FedRAMP High
(GovCloud)
Cloud Trail Yes Yes
CloudWatch Logs Yes Yes
IAM Yes Yes
Quick Sight Yes No
Lambda Yes JAB Review
AWS Config Yes JAB Review
Inspector Yes JAB Review
Systems Manager JAB Review JAB Review
Guard Duty 3PAO Assessment 3PAO Assessment
CloudWatch Events 3PAO Assessment 3PAO Assessment
Code Build, Commit, Deploy 3PAO Assessment 3PAO Assessment
Step Functions 3PAO Assessment 3PAO Assessment

23. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.P U B L I C S E C TO R
S U M M I T
How federal agencies can leverage AWS to extend CDM programs and CIO Metric
Reporting
https://aws.amazon.com/blogs/security/how-federal-agencies-can-leverage-aws-to-
extend-cdm-programs-and-cio-metric-reporting/
How to Apply the U.S. Department of Homeland Security’s Continuous Diagnostics
and Mitigation Programs on AWS
https://aws.amazon.com/blogs/publicsector/how-to-apply-the-u-s-department-of-
homeland-securitys-continuous-diagnostics-and-mitigation-programs-on-aws/
AWS Security Incident Response
https://d1.awsstatic.com/whitepapers/aws_security_incident_response.pdf
NIST Cyber Security Framework (CSF)
https://d1.awsstatic.com/whitepapers/compliance/NIST_Cybersecurity_Framework
_CSF.pdf

24. Thank you!
© 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.P U B L I C S E C TO R
S U M M I T
Evan Uhl
Director, Consulting Expert
CGI Federal
Darren House
Sr. Solutions Architect
AWS

25. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.P U B L I C S E C TO R
S U M M I T