AWS re:Invent re:Cap Security Highlights

Copyright © 2018 nVisium LLC · 590 Herndon Parkway Suite 120, Herndon VA 20170 · 571.353.7551 · www.nvisium.com
AWS re:Invent re:Cap
December 5, 2018

WHO WE ARE
Jerry Gamblin
Principal Security Engineer, Kenna Security
@JGamblin
John Poulin
Director of Engineering, nVisium
@forced_request
Jonn Callahan
Principal Security Consultant & AWS Security Lead, nVisium
@JonnCallahan

About nVisium & Kenna Security

Security Hub

Security Hub
• Integrates with:
– Amazon GuardDuty
– Amazon Inspector
– Amazon Macie
• Performs Automatic CIS Benchmark
scanning

Amazon Security Hub Talks
• Introduction to AWS Security Hub (SEC397)

Amazon S3

Amazon S3
• 2nd Oldest AWS Service (Circa 2006)
• Rich history of Access Control failures
– Publicly Readable/Listable S3 Buckets
• Popular for content delivery

Amazon S3 (the new)
• Public Access Settings
• AWS Transfer for SFTP
• Intelligent-Tiering
• S3 Object Lock

Amazon S3 – Public Access
– Control public settings for accounts

Amazon S3 – SFTP
– Create an S3-backed SFTP Server
– Select Identity Provider for access control

Amazon S3 – Intelligent Tiering
– Switches between Standard / Infrequently
Accessed
– Select Identity Provider for access control

Amazon S3 – S3 Object Lock
– Prevent Removal/Modification of Object
– Governance/Compliance Modes dictate who can
modify the data
– Enabled at Bucket level during creation

Amazon S3 – Best Practices
• Review Bucket ACLs (legacy)
• Review Bucket Policies
• Enable Server and Object-level Logging
• Encrypt Files
• Utilize Versioning

Amazon S3 Talks
• Best Practices to Secure Data Lake on AWS
(ANT327)
• AWS Transfer for SFTP, a Fully Managed
SFTP Service (STG326)

Serverless

Amazon Lambda
• Lambda Layers
• Lambda Custom Runtime
• Firecracker
• Lambda + Application Load Balancer

Amazon Lambda Layers
• Integrate Libraries / Dependencies with
Lambda functions
• Up to 5 Layers per function
• Cannot exceed (unzipped) package size:
250MB
• Supports public layers

Amazon Lambda Layers

Amazon Lambda Custom Runtimes
• Add custom runtime as a Layer
• Published Implementations: C++ and Rust
• Ruby added as native runtime

Amazon Lambda Custom Runtimes

Amazon Lambda Firecracker
• Lightweight MicroVM
• Powering AWS Lambda and AWS Fargate
• Open Source Project
– https://github.com/firecracker-
microvm/firecracker
• Available on .metal instances, and on-
prem bare metal servers

Amazon Lambda Application Load Balancer
• Lambda triggered via ALB
• Process HTTP(S) reqs via a serverless arch
• Great for green/blue hybrid arch migration
• Health checks + failover meets serverless

Amazon Lambda Best Practices
• Manually set timeouts when calling external
services depending on how much exec time
is left for the Lambda
• Reserved concurrency
• Avoid recursion (99% of the time, anyway)
• Take care calling invoke + invoke_async with
user-provided data
• Pre-warming (but pre-mature optimization
should be avoided)

Amazon Serverless Talks
• A Serverless Journey: AWS Lambda Under
the Hood (SRV409)
• Applying Principles of Chaos Engineering to
Serverless (DVC305)

AWS RE:INFORCE

Questions?
• Q&A
• Slides and recommended talks will be made
available after this webinar.

Contact Us
• nVisium Contact Info:
– https://www.nVisium.com
– contact@nvisium.com
– @nVisium
• Kenna Security Contact Info:
– https://www.kennasecurity.com/
– hello@kennasecurity.com
– @KennaSecurity

AWS re:Invent re:Cap Security Highlights

Recommended

Recommended

More Related Content

What's hot

What's hot (20)

Similar to AWS re:Invent re:Cap Security Highlights

Similar to AWS re:Invent re:Cap Security Highlights (20)

Recently uploaded

Recently uploaded (20)

AWS re:Invent re:Cap Security Highlights