A Self-Defending Border: Protect Your Web-Facing Workloads with AWS Security Services In this session you will learn how to build a self-defending border to protect your Internet-facing applications. We will show you how you can automatically respond to the dynamic threats facing online assets by using our managed threat detection services combined with information from applications. Shane Baldacchino, Solutions Architect, Amazon Web Services

1. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Shane Baldacchino
Solutions Architect, Amazon Web Services
Self Defending Borders
Protect Your Web-facing Workloads With AWS Security Services

2. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
What To Expect From The Session
Together, we will:
• Dive right in!
• Explore a use case of edge transformation using AWS
WAF, AWS Shield, & AWS Guard Duty in conjunction
with other AWS services.
• Walk through a demo of how a self defending AWS
architecture will increase your security posture.
• Take a deep dive into the architecture behind the
demonstration.

3. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Increased
Frequency
Low Capital
Investment
Rules and
Regulations
Disparate
Non Connected
System
Modern Business Challenges

4. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Threats Facing Online Assets?
There Are Many

5. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
OWASP Style
Attacks
Critical Web
Application Security
Risks

6. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
OWASP - Injection
User Input DatabaseWebsite
SELECT * FROM Users
WHERE Name = "Shane" AND Pass = "XXXX"
User = "Shane"
Pass = "XXXX"
SELECT Statement

7. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
SELECT * FROM Users
WHERE Name ="" or ""="" AND Pass ="" or ""=""
Malicious Actor Website
User = " or ""="
Pass = " or ""="
SELECT Statement
Database
OWASP - Injection

8. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
OWASP Style
Attacks
Critical Web
Application Security
Risks
Hacktivists &
Crime Syndicates
External Threats

9. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Control
Server
Victim Website
Bots
Malicious
Actor
Botnets And DDoS

10. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
We Use Controls
How Are We Fighting These Threats Today?

11. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
L3 – L7
Firewalls
Monitoring
Static Analysis
DDoS
Mitigation
Source Destination
Checks
BGP Announcements
Traffic Rerouting
Static Application
Security Testing
Log File Analysis

12. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Expensive False PositivesLack
Automation
CAPEX Heavy
Over Provisioning
License Locked
Integration Challenges
With DevSecOps
Models
Content Changes
Often Require New
Rules

13. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Let’s Make This Real…

14. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
• N-Tier Architecture
• ERP and CRM Integration
• Quickly Growing
• Limited IT resources
The Snowy Unicorn Elevator Company

15. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Availability Zone A Availability Zone B
Auto Scaling Group
EC2
instances
EC2
instances
Application
Load Balancer
MySQL DB MySQL DB
Application
Load Balancer
Amazon
Route 53
Bastion
Host
Online Architecture

16. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
• Designed For Penetration Testing
and Security Auditing
• Contains Several Hundred Tools
• Available in AWS Marketplace
Kali Linux

17. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Architecture Of Attacks - Discovery

18. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Architecture Of Attacks - Crawl

19. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Architecture Of Attacks - OWASP

20. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Architecture Of Attacks - DOS

21. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Architecture Of Attacks - Brute Force

22. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Demo
The Snowy Unicorn Elevator Company

23. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
What’s Wrong With Our Architecture?
L7 Attacks Scale, Cost &
Reputation
Traditional security
control were
ineffective
ASG Elasticity
Network Bandwidth
Flew under the radar
Visibility

24. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
We Need A Smarter Approach
And New Tools

25. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Standard Protection Advanced Protection
Paid service that provides
additional, comprehensive
protections from large and
sophisticated attacks
Available to ALL AWS
customers at No
Additional Cost
AWS Shield

26. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Control
Server
Victim Website
Bots
Malicious
Actor
Botnets And DDoS

27. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Control
Server
Bots
Malicious
Actor
Botnets And DDoS
Victim Website

28. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Comprehensive
API Integration
Leverage IP
Reputation Lists
Mitigate OWASP
Vulnerabilities
AWS WAF

29. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Step 2
Amazon CloudFront
checks if request
requires WAF
Step 1
HTTP/HTTPS Request
made for content to
Amazon CloudFront
AWS WAF Request Process

30. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Error Page Delivered by Amazon CloudFront
Step 1
HTTP/HTTPS Request
made for content to
Amazon CloudFront
AWS WAF Request Process
Step 3
WAF reviews request;
instructs Amazon
CloudFront to allow/deny
Step 2
Amazon CloudFront
checks if request
requires WAF

31. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Step 3
WAF reviews request;
instructs Amazon
CloudFront to allow/deny
Step 2
Amazon CloudFront
checks if request
requires WAF
Content Delivered via Amazon CloudFront
Step 1
HTTP/HTTPS Request
made for content to
Amazon CloudFront
AWS WAF Request Process
Error Page Delivered by Amazon CloudFront

32. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Step 4
WAF sends metric to
Amazon CloudWatch. Rule
can be updated via API
Step 3
WAF reviews request;
instructs Amazon
CloudFront to allow/deny
Step 2
Amazon CloudFront
checks if request
requires WAF
Step 1
HTTP/HTTPS Request
made for content to
Amazon CloudFront
Content Delivered via Amazon CloudFront
AWS WAF Request Process
Error Page Delivered by Amazon CloudFront

33. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Malicious Actor
SELECT * FROM Users
WHERE Name ="" or ""="" AND Pass ="" or ""=""
Website
User = " or ""="
Pass = " or ""="
SELECT Statement
Database
OWASP - Injection

34. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
SELECT * FROM Users
WHERE Name ="" or ""="" AND Pass ="" or ""=""
SELECT Statement
Malicious Actor Website
User = " or ""="
Pass = " or ""="
Database
OWASP - Injection

35. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.

36. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Let’s Get Proactive
Self Defending Borders

37. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
AWS
WAF
IP Whitelist / Blacklist
HTTP Flood Protection
OWASP Top 10 Protection
AWS ShieldAmazon
CloudFront
Application
Load
Balancer
Application Requests
(Static + Dynamic)

38. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Application
Load
Balancer
Amazon
CloudFront
Amazon S3
Bucket
Access Logs
OWASP Top 10 Protection
IP Whitelist / Blacklist
HTTP Flood Protection
Application Requests
(Static + Dynamic)
AWS Shield
AWS
WAF

39. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Amazon API
Gateway
Application
Load
Balancer
Amazon
CloudFront
Amazon S3
Bucket
Access Logs
Honey Pot
Endpoint
OWASP Top 10 Protection
IP Whitelist / Blacklist
HTTP Flood Protection
AWS
WAF
Application Requests
(Static + Dynamic)
AWS Shield

40. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
AWS WAF AWS Shield
Demo
The Snowy Unicorn Elevator Company

41. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Amazon
DynamoDB
Amazon
SQS
Amazon
SNS
Amazon
CloudWatch
AWS Step
Functions
Amazon
ElasticSearch
NoSQL
data store
Run code
without servers
AWS
Lambda
Simple, durable
object store
Monitoring for
cloud resources
Build distributed
applications
Highly scalable
push messaging
Fully managed
message queue
Scalable
ElasticSearch
Service
Integration
Tightknit API
Driven Platform
Amazon
S3

42. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Amazon API
Gateway
Application
Load
Balancer
Amazon
CloudFront
Amazon S3
Bucket
Access Logs
Honey Pot
Endpoint
OWASP Top 10 Protection
IP Whitelist / Blacklist
HTTP Flood Protection
AWS
WAF
Application Requests
(Static + Dynamic)
AWS Shield
AWS Step
Functions
Access Logs
AWS Lambda
Access Handler
OWASP Top 10 Protection
IP Whitelist / Blacklist
HTTP Flood Protection
Bad Bot & Scraper Protection

43. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Build and run
applications
without thinking
about servers
Availability and
scalability is
managed by
AWS
Not paying for
idle time
AWS Lambda

44. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Start
FirstState
ChoiceState
NextState
SecondMatchState DefaultStateFirstMatchState
End
AWS Step Functions

45. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Start
FirstState
Decision
{
"StartAt": ”FirstState",
"States":
{
"ManualApproval": {
"Type": "Task",
"Resource": "arn:aws:states:aws-region:xxxxxxxxxxx:activity:ManualStep",
"Next": ”Log_Ticket_InfoSec"
},
”Decision": {
"Type" : "Choice",
"Choices": [
{
"Variable": "$.user_agent",
"NumericEquals": 1,
"Next": "Yes"
},
{
"Variable": "$.user_agent",
"NumericEquals": 0,
"Next": "No"
}
]
},
”Update_AWS_WAF": {
"Type": ”Task",
"Resource": "arn:aws:states:aws-region:xxxxxxxxxxx:activity:UpdateWAF"
"End": true
}
Yes
(Manual Approval)
No
Define in JSON and Then Visualise in the Console
End

46. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Detected Attack
Blacklist
Router
New Attack Type
Manual Approval
Update WAF
Scraper ACL
Update WAF
BadBot ACL
Update EC2
Guest Firewall
Known Attack
Start
End

47. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Detected Attack
New Attack Type
Manual Approval
Known Attack
Start
End
Update WAF
Scraper ACL
Update WAF
BadBot ACL
Update EC2
Guest Firewall
Blacklist
Router

48. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Detected Attack
New Attack Type
Manual Approval
Known Attack
Start
End
Update WAF
Scraper ACL
Update WAF
BadBot ACL
Update EC2
Guest Firewall
Blacklist
Router

49. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
AWS WAF AWS ShieldAmazon API GatewayAWS Lambda AWS Step Functions
Demo
The Snowy Unicorn Elevator Company

50. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Amazon API
Gateway
Application
Load
Balancer
Amazon
CloudFront
Amazon S3
Bucket
Access Logs
Honey Pot
Endpoint
OWASP Top 10 Protection
IP Whitelist / Blacklist
HTTP Flood Protection
AWS
WAF
Application Requests
(Static + Dynamic)
AWS Shield
AWS Step
Functions
Access Logs
AWS Lambda
Access Handler
OWASP Top 10 Protection
IP Whitelist / Blacklist
HTTP Flood Protection
OWASP Top 10 Protection
IP Whitelist / Blacklist
Known Attacker Protection
HTTP Flood Protection
AWS Guard
Duty
Access Logs
AWS Lambda
Guard Duty and 3rd Party IP Lists
Amazon CloudWatch
Bad Bot & Scraper Protection

51. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Generate
findings through
VPC Log Stream
Queries to
questionable
domains
AWS CloudTrail
history of AWS
calls and user
activity
AWS Guard Duty

52. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Amazon GuardDuty Amazon CloudWatch
CloudWatch Event Amazon SNS Amazon SQS
AWS Step
Functions
AWS Lambda
Detection Report Act
AWS Platform
Automating Remediation

53. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Scanner & Probe Protection
OWASP Top 10 Protection
Bad Bot & Scraper Protection
IP Whitelist / Blacklist
Known Attacker Protection
HTTP Flood Protection
AWS
WAF
Amazon API
Gateway
AWS Step
Functions
AWS Lambda
Log Parser
AWS Guard
Duty
Amazon S3
Bucket
Access Logs
Application Requests
(Static + Dynamic)
Honey Pot
Endpoint
AWS Lambda
Guard Duty and 3rd Party IP Lists
AWS Lambda
Access Handler
Amazon CloudWatch
Application
Load
Balancer
AWS ShieldAmazon
CloudFront

54. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
AWS WAF AWS ShieldAmazon API Gateway AWS Lambda AWS Step FunctionsAWS Guard Duty
Demo
The Snowy Unicorn Elevator Company

55. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
AWS WAF Amazon API Gateway AWS Lambda
AWS ShieldAWS Step FunctionsAWS Guard Duty
Our Security Tool Box

56. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Let’s Do The Math
Can I Afford This?

57. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
All This For Under $20

58. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
AWS WAF
Web ACL and Rules $5 per month per WebACL + $1 per month per rule
Request Charge $0.60 per million requests
All This For Under $20
$16

59. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Amazon API Gateway
$3.50 per million API calls
$0.05$16
All This For Under $20

60. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
AWS Lambda
$0.20 per million requests
$0.02
$0.05$16
All This For Under $20

61. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
AWS GuardDuty
VPC Flow Log and DNS Log Analysis First 500GB $1.10 per GB
CloudTrail Event Analysis $4.40 per 1 million requests
$1.05$0.02
$0.05$16
All This For Under $20

62. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
AWS Step Functions
$0.025 per 100 state transitions
$1.05$0.02
$0.05$16
All This For Under $20
$0.10

63. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
AWS Shield - Standard
$0.00
$0.00$0.10
$1.05$0.02
$0.05$16
All This For Under $20

64. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Session Recap
Build Dynamic Security Architectures
Leverage the AWS platform to provide visibility and drive
maturity in to your InfoSec practice

65. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Session Recap
Build Dynamic Security Architectures
Leverage the AWS platform to provide visibility and drive
maturity in to your InfoSec practice
Comprehensive Security Portfolio
Security at AWS is the highest priority. Benefit from security
architecture for the most security-sensitive organisations

66. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Cost Optimised Security
Drive the cost of performing security down whilst providing
full stack automation with the AWS platform
Build Dynamic Security Architectures
Leverage the AWS platform to provide visibility and drive
maturity in to your InfoSec practice
Comprehensive Security Portfolio
Security at AWS is the highest priority. Benefit from security
architecture for the most security-sensitive organisations
Session Recap

67. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
AWS WAF AWS ShieldAmazon API Gateway AWS Lambda AWS Step FunctionsAWS Guard Duty
Let AWS do the undifferentiated
heavy lifting for you

68. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
WAF Automation - http://amzn.to/2gblvOz
Step Functions Approval Workflow -
http://amzn.to/2hkPOUF
AWS WAF
Product Details -
https://aws.amazon.com/shield/
Tutorial - http://amzn.to/2eS8GK9
How to get Started Today
Product Details - https://aws.amazon.com/waf/
Tutorial - http://amzn.to/2rBdR4Q
AWS Automation
AWS Shield

69. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Thank You
balshane@amazon.com