Threat Detection and Mitigation at Scale on AWS - SID301 - Toronto AWS Summit

© 2018, Amazon Web Services, Inc. or Its Affiliates. All rights reserved.
Nathan Case
Security Geek
SID301
Threat Detection and Mitigation at Scale
on AWS

AWS Identity & Access
Management (IAM)
AWS Organizations
AWS Cognito
AWS Directory Service
AWS Single Sign-On
AWS CloudTrail
AWS Config
Amazon
CloudWatch
Amazon GuardDuty
VPC Flow Logs
Amazon EC2
Systems Manager
AWS Shield
AWS Web Application Firewall
(WAF)
Amazon Inspector
Amazon Virtual Private Cloud
(VPC)
AWS Key Management
Service (KMS)
AWS CloudHSM
Amazon Macie
Certificate Manager
Server Side Encryption
AWS Config Rules
AWS Lambda
AWS Enterprise Support
Identity
Detective
control
Infrastructure
security
Incident
response
Data
protection
AWS security solutions

Why is traditional threat detection so hard?
CostSignal to noiseLarge datasets

Humans and data don’t mix

AWS CloudTrail
Track user activity
and API usage
Threat Detection: Log Data Inputs
VPC Flow Logs
IP traffic to/from
network interfaces
in your VPC
CloudWatch Logs
Monitor apps using
log data, store &
access log files
DNS Logs
Log of DNS queries
in a VPC when using
the VPC DNS
resolver

AWS CloudTrail

Detect with VPC Flow Logs
AWS
account
Source IP
Destination IP
Source port
Destination port
Interface Protocol Packets
Bytes Start & end time
Accept or
Reject

Amazon CloudWatch Logs Subscriptions
• Real-time feed of log events
• Delivered to an AWS Lambda
function or an Amazon Kinesis Data
Stream
• Supports custom processing,
analysis, loading into other systems
• Cross-account data sharing for
centralized log processing

Threat Detection
Amazon
GuardDuty
Intelligent threat detection and
continuous monitoring to
protect your AWS accounts and
workloads

What Can Amazon GuardDuty Detect?
RDP brute
force
RAT Installed
Crypto
Currency
Potential
Account
Breach
Exfiltrate temp
IAM creds
over DNS
Probe API with
temp creds
Attempt to
compromise
account

Rabbit Hole!
What Can You Detect using AWS services?
RDP brute
force
RAT Installed
Potential
Account
Breach
Exfiltrate
temp IAM
creds over
DNS
Probe API
with temp
creds
Attempt to
compromise
account

Infrastructure Domain
Availability Zone C
Availability Zone B
VPC CIDR: 10.0.0.0/16
Availability Zone A
10.0.0.0/19
Public subnet
10.0.32.0/20
Private subnet
10.0.48.0/21
Sensitive subnet
Security groups
Route table
NACLs
Internet Gateway
Instance compromise
Amazon
S3
Amazon
RDS
IAM
AWS
CloudHSM
AWS
Organization
s
AWSKMS
AWS
Directory
Service

Rabbit Hole!
What Can You Detect Using AWS Services?
Infrastructure
VPC Resources
Connectivity
On-instance
...
Service
IAM
S3 buckets
Billing
...
Application
Patching
Coding hole
...
Other?

Amazon GuardDuty Threat Detection
and Notification

Detecting Known Threats
Threat intelligence
• Feeds:
o AWS Security
o Commercial - CrowdStrike, Proofpoint
o Open source
o Customer provided - "format":
"[TXT|STIX|OTX_CSV|ALIEN_VAULT|PROOF_POINT|FIRE_EYE]",
• Known malware infected hosts
• Anonymizing proxies
• Sites hosting malware and hacker tools
• Cryptocurrency mining pools and wallets

Detecting Unknown Threats
Anomaly detection
• Algorithms to detect unusual behavior
o Inspecting signal patterns for signatures
o Profiling normal activity and looking at deviations
o Machine learning classifiers

Finding Types
Recon
• Port probe on unprotected port
• Outbound port scans
• Callers from anonymizing proxies
Backdoor
• Spambot or C&C activity
• Exfiltration over DNS channel
• Suspicious domain request
Trojan
• Domain Generation Algorithm (DGA)
domain request
• Blackhole traffic
• Drop point
Unauthorized Access
• Unusual ISP caller
• SSH/RDP brute force
Stealth
• Password policy change
• AWS CloudTrail logging disabled
• Amazon GuardDuty disabled in member
account
Cryptocurrency
• Communication with bitcoin DNS pools
• Cryptocurrency related DNS calls
• Connections to bitcoin mining pool

Visibility to Answer the Tough Questions
• What data do I have in the cloud?
• Where is it located?
• Where does my sensitive data exist?
• What’s sensitive about the data?
• What PII/PHI is possibly exposed?
• How is data being shared and stored?
• How and where is my data accessed?
• How can I classify data in near-real time?
• How do I build workflow remediation for my security and compliance needs?

Example Walkthrough: CloudWatch Events
Your AWS Account, GuardDuty generates Finding and sends to CloudWatch Events. CloudWatch Events
forwards to CloudWatch Event Bus in the Master Account.
{
"account": "123456789012",
"region": "us-west-2",
"detail": {
"description": "EC2 instance i-99999999 is querying a domain name that is associated
with Bitcoin-related activity.",
"resource": {
"resourceType": "Instance",
"instanceDetails": {
...
"instanceId": "i-99999999",
"instanceState": "running",
...
"instanceType": "p2.xlarge”},
...
"title": "Bitcoin-related domain name queried by EC2 instance i-99999999.",
...
}

In the the Master Account, CloudWatch Events triggers the Response Handler Lambda function to analyze the event by
processing signature logic for conditional evaluation.
{
"account": "123456789012",
"detail": {
"description": "EC2 instance i-99999999...
with Bitcoin-related activity.",
"resource": {
"resourceType": "Instance",
"instanceDetails": {
...
"instanceState": "running",
...
"instanceType": "p2.xlarge”},
...
“type": “CryptoCurrency:EC2/Bitcoin...”
...
}
Example Walkthrough: Lambda Trigger
"account": "123456789012",

In the AWS, the Response Handler Lambda function analyzes the event by processing conditional logic to
determine responsive Action, which in this case is to terminate the instance(s).
Example Walkthrough: Response Handler
"account": "123456789012",
TerminateInstanceTest:
cloudwatch.event:
- name: guardduty
- identifier: “CryptoCurrency:EC2/Bitcoin...”
- actions:
- "ec2:TerminateInstance"
- onlyif:
- and:
- region: 'us-west-2'
- or:
- account: 123456789012
- account: 123456789013

In the Master Account, if the event matches a signature the Response Handler Lambda function initiates a
StepFunction execution of the Response Action State Machine.
TerminateInstanceTest:
cloudwatch.event:
- name: guardduty
- identifier: “CryptoCurrency:EC2/Bitcoin...”
- actions:
- "ec2:TerminateInstance"
- onlyif:
- and:
- region: 'us-west-2'
- or:
- account: 123456789012
- account: 123456789013
{
"Account": “123456789012",
"SnsNotification": true,
"ec2": {
"RemoveEip": false,
"ApplySecurityGroup": false,
"SecurityGroupName": null,
"instanceId": [“i-99999999”],
"region": “us-west-2”,
"Snapshot": {
"ShareSnap": null
},
"StopInstance": false,
"CreateSnapshot": false,
"TerminateInstance": true
},
"sns": {...}
}

In the Master Account, the Response Action State Machine invokes a Lambda Response function to assume a
role in the Member AWS Account to take the responsive action of terminating the EC2 instance(s).
{
"Account": “123456789012",
"ec2": {
"RemoveEip": false,
"instanceId": [“i-99999999”],
"Snapshot": {
"ShareSnap": null
},
},
"sns": {...}
}

In the Master Account, the Response Action State Machine concludes by triggering Logging Handler Lambda
Functions to log and notify.
{
"Account": “123456789012",
"ec2": {
"RemoveEip": false,
"instanceId": [“i-99999999”],
"Snapshot": {
"ShareSnap": null
},
},
"sns": {...}
}
{
"Account": "",
"PrincipalUserName": "45732-update",
"SourceType": "aws.guardduty",
"EventType":
"CryptoCurrency:EC2/Bitcoin...",
"Region": "us-west-2",
"Time": "2018-05-30T20:07:55Z",
"Identifier":
"CryptoCurrency:EC2/Bitcoin...",
"Resources": [“i-99999999”]
}

Example Walkthrough: Conclusion
• By identifying the conditional logic and the Predefined
Action, the security event triggered an automated
response from your automated remediation.
• The response required no human intervention.
• Humans are free to move up the value chain to
continually improve conditional logic and Predefined
Actions.
• Time to remediation is exponentially reduced when
compared to manual response.

Threat Detection: Triggers
Amazon CloudWatch
Events
Delivers a near real-time stream of
system events that describe
changes in AWS resources
AWS Config rules
Continuously tracks your resource
configuration changes and if they
violate any of the conditions in your
rules

AWS Config Rules
A continuous recording and assessment service
Changing resources
AWS Config
AWS Config rules
History
snapshot
Notifications
API access
Normalized
• How are my resources configured over time?
• Is a change that just occurred to a resource, compliant?

Amazon CloudWatch Events
{
"source": [
"aws.guardduty"
]
}
CloudWatch
Event
GuardDuty
findings
Lambda
function

Threat Remediation: Automation
AWS Systems Manager
Automate patching and
proactively mitigate threats at
the instance level
AWS Lambda
Capture info about the IP
traffic going to and from
network interfaces in your VPC

Amazon
CloudWatch
AWS
CloudTrail
AWS Config
Lambda
function
AWS APIs
AWS WAF
AWS Shield
Detection
Alerting
Remediation
Countermeasures
Forensics
Team
collaboration
(Slack etc.)
Amazon GuardDuty
VPC Flow Logs
AWS Step functions
Responding to Findings: Remediation
Amazon EC2
Systems
Manager
Amazon EC2

High-Level Playbook
Adversary
or intern
Your environment Lambda
responder
CloudWatch Events

Demo

Lambda + Systems Manager + CloudWatch
AWS Systems
Manager
documents
Amazon
CloudWatch
rule
EC2 instance contents
Instance:~ ec2-user$ _
AWS
Lambda
Amazon
GuardDuty
Lambda
function

AWS Systems
Manager
documents
Amazon
CloudWatch
rule
AWS
Lambda
Amazon
GuardDuty
elastic network
interface
elastic network
interface
Lambda
function

AWS Systems
Manager
documents
Amazon
CloudWatch
rule
AWS
Lambda
Amazon
GuardDuty
elastic network
interface
elastic network
interface
Lambda
function
EBS Volume

AWS Systems
Manager
documents
Amazon
CloudWatch
rule
AWS
Lambda
Amazon
GuardDuty
elastic network
interface
elastic network
interface
Lambda
function
EBS Volume
80, 443->DataSG

AWS Systems
Manager
documents
Amazon
CloudWatch
rule
AWS
Lambda
Amazon
GuardDuty
elastic network
interface
elastic network
interface
Lambda
function
EBS Volume
3389 -> 0.0.0.0/0
80, 443->DataSG

AWS Systems
Manager
documents
Amazon
CloudWatch
rule
AWS
Lambda
Amazon
GuardDuty
elastic network
interface
Lambda
function
EBS Volume
80, 443->DataSG

AWS Systems
Manager
documents
Amazon
CloudWatch
rule
Instance:~ ec2-user$
top
pcap
lime
AWS
Lambda
Amazon
GuardDuty
elastic network
interface
elastic network
interface
Lambda
function
EBS Volume

AWS Systems
Manager
documents
Amazon
CloudWatch
rule
top
pcap
lime
AWS
Lambda
Amazon
GuardDuty
Lambda
function
EBS Volume EBS Forensics

AWS Systems
Manager
documents
Amazon
CloudWatch
rule
Instance:~ ec2-user$ top
Instance:~ ec2-user$ pcap
Instance:~ ec2-user$ lime
AWS
Lambda
Amazon
GuardDuty
Lambda
function
EBS Volume

AWS Systems
Manager
documents
Amazon
CloudWatch
rule
AWS
Lambda
Amazon
GuardDuty
Lambda
function
EBS Volume
Amazon EBS
snapshot

AWS Lambda: Run Code in Response to Events
Function Services
Changes
in data
state
Requests to
endpoints
Changes
in resource
state
Node
Python
Java
C#
Event source

• Asynchronously
execute commands
• No need to
SSH/RDP
• Commands and
output logged
Remediating Threats on Amazon EC2 Instances
Amazon EC2 Systems Manager - Run
Command
EC2 Instances
Lambda
function
AWS Systems Manager
Amazon
EC2

Threat Detection and Remediation Partner Solutions
Consulting, data analysis, threat detection, and managed security operations

Open Source Resources
ThreatResponse
https://threatresponse.cloud
Cloud Custodian
https://github.com/capitalone/cloud-custodian
Security Monkey
https://github.com/Netflix/security_monkey
CloudSploit
https://github.com/cloudsploit
StreamAlert
https://github.com/airbnb/streamalert
AWS CIS Foundation Framework
https://github.com/awslabs/aws-security-benchmark
AWS IR
https://github.com/ThreatResponse/aws_ir

Submit Session Feedback
1. Tap the Schedule icon. 2. Select the session you
attended.
3. Tap Session Evaluation to
submit your feedback.

Threat Detection and Mitigation at Scale on AWS - SID301 - Toronto AWS Summit

Recommended

Recommended

More Related Content

What's hot

What's hot (19)

Similar to Threat Detection and Mitigation at Scale on AWS - SID301 - Toronto AWS Summit

Similar to Threat Detection and Mitigation at Scale on AWS - SID301 - Toronto AWS Summit (20)

More from Amazon Web Services

More from Amazon Web Services (20)

Threat Detection and Mitigation at Scale on AWS - SID301 - Toronto AWS Summit