Automating AWS Security with Serverless Technology
•Download as PPTX, PDF•
2 likes•231 views
In this presentation, Luc van Donkersgoed explains how to use Serverless Technology (AWS Config, AWS Lambda, AWS CloudWatch Events, AWS SecurityHub) to improve the security of hundreds of AWS accounts. Examples include automatic remediation with SSM documents and Lambda, manual remediation with SecurityHub and SSH through SSM.
Recommended
Recommended
More Related Content
What's hot
What's hot (20)
Similar to Automating AWS Security with Serverless Technology
Similar to Automating AWS Security with Serverless Technology (20)
Recently uploaded
Recently uploaded (20)
Automating AWS Security with Serverless Technology
- 1. Automating AWS Security with Serverless Technology L u c v a n D o n ke r s g o e d
- 2. About Sentia • Managed Service Provider • Full Lifecycle Support • AWS MSP • Azure Expert MSP
- 3. About Sentia • Many public cloud customers • Many AWS accounts • Many engineers working on environments
- 4. This is our security officer
- 5. He’s happy to monitor one account
- 8. Or hundreds of accounts…
- 9. … becomes a bit of a challenge.
- 10. This is the story how Sentia manages hundreds of accounts…
- 11. This is the story how Sentia manages hundreds of accounts… And keeps its security officer happy at the same time.
- 12. What we’re building today
- 13. DevOps vs DevSecOps In DevOps, you should be able to: • Deploy your code or infrastructure fast • Fail fast • Observe what went wrong • Improve
- 14. Introducing DevSecOps With DevSecOps, the same applies, but for security.
- 15. What we’re trying to achieve • Anyone should be able to deploy anything • If there is an issue, it gets resolved automatically • Security is observable
- 16. Technologies used • AWS Config • AWS GuardDuty • AWS Lambda • AWS Systems Manager (SSM) • AWS SecurityHub • AWS CloudTrail
- 20. Create a Config Rule
- 24. First four steps: done
- 26. Automatic remediation with SSM
- 27. Set the Config Remediation Action
- 28. AWS SSM Document
- 29. Automatic remediation with Lambda
- 32. When to use which automatic remediation method?
- 33. Automatic remediation methods SSM Documents • Plain patching • Only AWS API calls CW Events • Complex events • Multiple events • Fan out
- 34. Multiple CloudWatch Event Targets
- 35. Automatic remediation makes our security officer happy
- 37. When to use manual remediation? • Human judgment • Different cases, different actions
- 39. CW Event to Security Hub Lambda
- 40. Finding in Security Hub
- 44. Why use Security Hub • Multiple sources (Config / GuardDuty) • Custom sources • 42 CIS AWS Foundations insights • Multi-account • Multiple targets (eg. Slack / PagerDuty) • Direct remediation
- 45. Security Hub
- 46. Security Hub
- 47. Having all findings in one place and being able to remediate them makes our security officer happy
- 48. But what about EC2?
- 49. Potential problems with EC2 • Patch observability • Effort of updating packages • Insecure SSH • Untraceable SSH
- 50. Introducing SSM
- 51. EC2 communicates with SSM
- 52. SSM communicates with EC2
- 53. Config communicates with SSM
- 54. Use cases
- 56. Query installed packages (tomcat)
- 57. Query installed packages (kernel)
- 58. This gives us patch observability
- 59. SSM also allows for manual and automatic patching
- 60. Using SSM to SSH to EC2 instances without keypairs and without opening port 22
- 61. No key pair
- 62. No public IP
- 63. No port 22
- 64. But we do have SSH!
- 65. It uses the same SSM tech
- 66. All sessions are logged
- 67. All output can be stored in S3 or CloudWatch
- 68. Recap
- 69. 1. Simple best practices can be automatically enforced with Config and SSM
- 70. 2. Complex best practices can be automatically enforced with Config, CW Events and Lambda
- 71. 3. Security Hub aggregates findings and allows for manual remediation
- 72. 4. SSM Reports inventory to Config
- 73. 5. Users can execute commands on EC2 with SSM
- 74. 6. This includes setting up SSH tunnels