AWS Meet Up Copenhagen April 2022

1. ADD YOUR
BRAND HERE
Thinking Out cLOUD 2022
AWS COPENHAGEN
@stuhirstinfosec
/stuhirst

2. ADD YOUR
BRAND HERE

3. ADD YOUR
BRAND HERE

4. ADD YOUR
BRAND HERE
Disclaimers;
BRACE FOR MEMES.
I’m not an ‘expert’ or a
‘thought leader’, but I’ve
learned some stuff along the
way.
@stuhirstinfosec

5. ADD YOUR
BRAND HERE
Who Am I?
@stuhirstinfosec

6. ADD YOUR
BRAND HERE

7. ADD YOUR
BRAND HERE

8. ADD YOUR
BRAND HERE

9. ADD YOUR
BRAND HERE
So, where to even
begin with this
Security nonsense?!

10. ADD YOUR
BRAND HERE

11. ADD YOUR
BRAND HERE
What do you care
about?!

12. ADD YOUR
BRAND HERE
Risks
Threats
Vulnerabilities
Business Context

13. ADD YOUR
BRAND HERE
There are existing frameworks that can help;
• CIS Benchmarking
• NIST
• ISACA
• Cloud Security Alliance

14. ADD YOUR
BRAND HERE

15. ADD YOUR
BRAND HERE

16. ADD YOUR
BRAND HERE

17. ADD YOUR
BRAND HERE
Threats

18. ADD YOUR
BRAND HERE
Cryptojacking /
Bitcoin Mining
Accessing resources you own to leverage computing power to
mine for cryptocurrency

19. ADD YOUR
BRAND HERE
Data Breaches
(hackers/bots)
Open buckets
Open databases
General misconfiguration
Privilege escalation
Leaked keys

20. ADD YOUR
BRAND HERE
Denial Of Service
Though if major Cloud providers are down - everyone has a
problem!

21. ADD YOUR
BRAND HERE
Insider Threats
Malicious or mistake

22. ADD YOUR
BRAND HERE
Hijacking of
Accounts/Domains
To log on and access resources and data

23. ADD YOUR
BRAND HERE
Lack of awareness &
training
Cloud is still new and complex!

24. ADD YOUR
BRAND HERE
Business
Context

25. ADD YOUR
BRAND HERE

26. ADD YOUR
BRAND HERE
Practical Steps To Protect
Your AWS Environments

27. ADD YOUR
BRAND HERE
Look out
for…

28. ADD YOUR
BRAND HERE
ROOT ACCOUNT

29. ADD YOUR
BRAND HERE
@stuhirstinfosec
Give your Root Account physical
MFA token to someone non-technical
They’re less likely to kill your
business

30. ADD YOUR
BRAND HERE

31. ADD YOUR
BRAND HERE
BANANA
SKIN
ALERT!

32. ADD YOUR
BRAND HERE
@stuhirstinfosec
Advice:
Delete your Root Account Access
Key and Secret Key ID - you don’t
need them!

33. ADD YOUR
BRAND HERE
MFA

34. ADD YOUR
BRAND HERE
Ensure EVERY user
has MFA - no
excuses!
Or SAML/SSO…

35. ADD YOUR
BRAND HERE
@stuhirstinfosec
Advice:
You can stipulate in IAM policies that
an action CANNOT take place without
MFA!

36. ADD YOUR
BRAND HERE
@stuhirstinfosec
So perhaps you can perform:
DescribeInstances and RunInstances with no
checks
But TerminateInstance can only be where
aws:MultiFactorAuthAge is < X
minutes

37. ADD YOUR
BRAND HERE
IAM

38. ADD YOUR
BRAND HERE
Check your IAM password policy
Automate checks for unused
passwords or access keys
ALERT FOR ROOT USAGE!!!

39. ADD YOUR
BRAND HERE
BANANA
SKIN
ALERT!

40. ADD YOUR
BRAND HERE

41. ADD YOUR
BRAND HERE
Over time, you have probably
created too many roles!
IAM Access Advisor - service last
accessed

42. ADD YOUR
BRAND HERE
LOGGING

43. ADD YOUR
BRAND HERE
LOG. ALL. THE. THINGS!

44. ADD YOUR
BRAND HERE
Cloudtrail
S3 Access
VPC Flow
Cloudwatch
API Gateway

45. ADD YOUR
BRAND HERE
At WORST - make sure you’re
logging Cloudtrail events in every
account.
ALERT IF YOU’RE NOT!

46. ADD YOUR
BRAND HERE
S3 BUCKETS

47. ADD YOUR
BRAND HERE
Still arguably the easiest mistake
to make and most impactful

48. ADD YOUR
BRAND HERE

49. ADD YOUR
BRAND HERE
BANANA
SKIN
ALERT!

50. ADD YOUR
BRAND HERE

51. ADD YOUR
BRAND HERE

52. ADD YOUR
BRAND HERE
Be Careful:
A bucket can be restricted, but an
object within it can still be
readable!

53. ADD YOUR
BRAND HERE
SECURITY GROUPS

54. ADD YOUR
BRAND HERE
SG’s act like a firewall for your
instances….
But they’re easy to misconfigure

55. ADD YOUR
BRAND HERE
BANANA
SKIN
ALERT!

56. ADD YOUR
BRAND HERE

57. ADD YOUR
BRAND HERE
• Restrict traffic to internal IPs for protocols such as
SSH
• Use NACL’s to block ports
• Avoid the dreaded 0.0.0.0/0
• Use ELB's SGs wisely to restrict EC2’s access to
the Internet
• Trusted Advisor will help you!

58. @stuhirstinfosec

59. ADD YOUR
BRAND HERE
INCIDENT
RESPONSE

60. ADD YOUR
BRAND HERE
Behaviour
Alert
Slack

61. ADD YOUR
BRAND HERE
Create playbooks for incident
response
Even if they just say who to
contact!!!

62. ADD YOUR
BRAND HERE
ENCRYPTION

63. ADD YOUR
BRAND HERE
Are you encrypting
by default?
If not, why not?!
S3, EBS, RDS etc

64. ADD YOUR
BRAND HERE
KEY ROTATION &
CREDS

65. ADD YOUR
BRAND HERE

66. ADD YOUR
BRAND HERE
North Carolina State University
examined accidental leakage of
authentication secrets to
GitHub…..

67. ADD YOUR
BRAND HERE
1. Secrets in over
100,000
repositories
2. Over 1000
committed daily

68. ADD YOUR
BRAND HERE
Other helpful tips!

69. ADD YOUR
BRAND HERE
Well Architected
Reviews with AWS
Use your Technical
Account Managers!

70. ADD YOUR
BRAND HERE
Manually audit
your accounts -
looking for gaps,
misconfigs,
permissions

71. ADD YOUR
BRAND HERE
Or leverage….
Open Source
Goodies!

72. ADD YOUR
BRAND HERE

73. ADD YOUR
BRAND HERE

74. ADD YOUR
BRAND HERE

75. ADD YOUR
BRAND HERE

76. ADD YOUR
BRAND HERE
The most important
part of securing
AWS…

77. ADD YOUR
BRAND HERE
RECRUIT!
RECRUIT!
RECRUIT!

78. ADD YOUR
BRAND HERE
TAKEAWAYS

79. ADD YOUR
BRAND HERE
• Start with basics - what do you
care about
• Establish a risk framework
• Look out for the banana skins!
• Automate as much as you can
• Leverage the tooling
• Have fun!
• RECRUIT!

80. ADD YOUR
BRAND HERE
So what have I learnt these last 2-3 years?
* Your journey has to start somewhere!
* Changing businesses takes real time and graft. And
it’s painful!
* Try and get the major stakeholders around the table
regularly to collaborate - this takes effort!
* Cloud is HARD and often COMPLEX
* Recruitment is absolutely KEY!
* TEACHING EACH OTHER IS KEY ALSO!!!

81. ADD YOUR
BRAND HERE
Before I leave you…

82. ADD YOUR
BRAND HERE

83. ADD YOUR
BRAND HERE

84. ADD YOUR
BRAND HERE

85. ADD YOUR
BRAND HERE
Want to know more?
Cloud Security Forum on Slack - DM ME ON
TWITTER!
AWS Arsenal - open source tools
https://github.com/stuhirst/awssecurity
AWS Vulnerability & Risk list
https://github.com/stuhirst/awssecurity/blob/master/risksan
dvulns.md

86. ADD YOUR
BRAND HERE
Thanks!
Questions?!
@stuhirstinfosec