from day 4 of AWS NYC loft security week

1. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved
Amazon GuardDuty Lab
Greg McConnel,
Security Solutions Architect
Jesse Fuchs,
Security Solutions Architect

2. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved
Amazon GuardDuty
1. Intro to GuardDuty & Demo - 20 min
2. Lab 1 – Discovery & Remediation – EC2 - 35 min
3. Discussion - 10 min
4. Lab 2 – Discovery & Remediation – IAM - 35 min
5. Discussion - 10 min
6. Summary & Closing - 10 min
Amazon GuardDuty

3. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved
Amazon GuardDuty
Quick Intro – very quick, I promise…
Amazon GuardDuty

4. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved
Demo Start

5. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved
GuardDuty
Amazon GuardDuty is a managed threat detection service that
continuously monitors for malicious or unauthorized behavior to
help you protect your AWS accounts and workloads.

6. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved
GuardDuty Role Playing

7. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved
GuardDuty Threat Detection and Notification

8. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved
Demo Finish

9. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved
Amazon GuardDuty
http://lab.gregmcconnel.net/

10. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved
Amazon GuardDuty Lab 1
The first lab will generate GuardDuty findings when an EC2 instance attempts to connect to a IP in a customer
Threat List. We will assume this instance is compromised and isolate it using a Security Group. Here are the
steps:
• Environment Setup – Create Elastic IP and add this to a Custom Threat List. Run CloudFormation
Template
• Attack Simulation – In the background the ”Compromised” instance will connect with the “Malicious”
instance, generating GuardDuty findings
• Remediation – A Lambda function will be added that will remove the ”Compromised” instance from its
current Security Group and add it to one with no Ingress or Egress rule
• Extra Credit – Enhance the Lambda function to take additional actions on the ”Compromised” instance
http://loftlab.gregmcconnel.net/
http://lab.gregmcconnel.net/

11. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved
Amazon GuardDuty Lab 1 Part 1 http://loftlab.gregmcconnel.net/

12. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved
Amazon GuardDuty Lab 1 – Part 2 http://loftlab.gregmcconnel.net/

13. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved
Amazon GuardDuty Lab 1
Discussion

14. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved
Amazon GuardDuty Lab 2
For the second lab you will be focused on generating and remediating GuardDuty findings related to
compromised IAM credentials. Below are the steps you’ll be walking through:
• Environment Setup – Run the CloudFormation template and create the additional resources
• Attack Simulation – Setup a profile for stolen EC2 credentials and use the AWS CLI to see what you have
access to
• Remediation – Review the auto remediation Lambda function and other recommended remediations.
Answer questions related to how you would remediate these within your own company
• Extra Credit – Enhance the Lambda function to output a more granular alert, process other GuardDuty
findings, or rotate Instance Profiles to limit downtime of an application
http://lab.gregmcconnel.net/

15. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved
Amazon GuardDuty Lab 2 http://loftlab.gregmcconnel.net/

16. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved
Amazon GuardDuty Lab
Discussion

17. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved
Amazon GuardDuty Next Steps
Enable GuardDuty - monitor the cost and findings during the 30 day no
cost trial period – assess after 30 days where GuardDuty will sit in
your overall security strategy.
https://aws.amazon.com/guardduty/

18. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved
aws.amazon.com/activate
Everything and Anything Startups
Need to Get Started on AWS