With security-relevant services such as AWS Config, VPC Flow Logs, Amazon CloudWatch Events, and AWS Lambda, you now have the ability to automatically respond to and process security events that may occur within your AWS environment. These including prevention, detection, response, and remediation. This session covers the process of automating security event response using various AWS building blocks, gaining confidence in your coverage by proactively testing security monitoring and response effectiveness before anyone else does.

1. Automating Security
Event Response
Steve Turner, Solutions Architect

2. What to Expect from the Webinar
• SecDevOps: What?
• Services and features galore: What do I use?
• Using relevant services
Improve your quality of life

3. What’s the problem?

4. Meet Toby, Software developer
Flexibility,
Speed,
Low cost,
Reliability,
..
..
..
Freedom to be creative
….throughout his professional career of 2 full years!
Is a do-er
Wants impact

5. Meet Joe, Mr. Security
• Leading cloud adoption efforts
• Part of central cloud security team
• Manages other infrastructures
• Deals with security escalations
• Does not like being in critical path
• Wants to work smart, but has to
work hard
Ultimately responsible for security

6. Security: A lot going on
Security Policy
Compliance regimes
Report compliance
Evangelize cloud within the org and outside
Put out fires
Investigate issues deeply

7. AWS Tools could help
AWS Config Rules
AWS CloudTrail
AWS Trusted Advisor
Amazon CloudWatch Events
Amazon VPC Flow Logs
AWS WAF
AWS Identity & Access
Management (IAM)

8. Security: A lot going on
Security Policy
Compliance regimes
Report compliance
Evangelize cloud within the org and outside
Put fires out
Investigate issues deeply
Many Many services
Many Many features

9. POLL
Do you automate your security
response today?

10. How do I sustain this?

11. Joe’s typical tasks
1. Create security policies
2. Assess compliance; help others check for compliance
3. Investigate and analyze relevant information; fix critical
security issues quickly
4. Deal with escalations
5. Generate evidence and reports

12. Create Policies

13. Policies in code
AWS Trusted Advisor Best Practice checks
• Get 35+ checks with zero effort
• Example: ELBs with missing security groups, S3 Bucket open
access permissions, etc.
• Create an administrator role in each account
• Assume admin role to read check status using TA APIs
• DescribeTrustedAdvisorCheckSummaries
• DescribeTrustedAdvisorCheckResult
Useful for broadly applicable policies with no specific exceptions

14. AWS Trusted Advisor demo

15. Policies in code
AWS Config Rules Managed and Custom Rules
Managed Rules
• Pre-built, but need to turn on
• Triggered periodically/on changes and apply to specific resources
• Modify publishes source on GitHub to customize further
Useful for resources with specific policies. Flexible.

16. AWS Config: Managed Rules demo

17. Policies in code
Custom Rules
• Write up your own rules. Ultimate flexibility
• Publish your best practices on GitHub
• Annotate results to add policy details or tickets

18. AWS Config: Custom Rules demo

19. Codify recommendations
Also see:
https://github.com/awslabs/aws-config-rules

20. Create Policies in code

21. Assess Compliance

22. Assess compliance
• Audit assessment is a spot check
• Policies in code à Continuous assessments
• Self service governance
• Prioritize assessments
• Find an owner for the result

23. Options for assessing compliance
AWS Config Rules to assess and report configuration
compliance
• Annotate results with resource owner
• Custom Rules integrate with ticketing

24. AWS Config + Inventory
Amazon EC2 Systems Manager and AWS Config will
capture
• Software Inventory in Amazon EC2 instance
• Firewall rules
• Patch level
• Application version
Assess compliance using AWS Config Rules

25. Inventory Assessment

26. Create Policies in code
Assessment and Governance

27. Fix violations quickly

28. Using AWS Config Rules and Amazon CloudWatch
Events
Use Amazon CloudWatch Events and AWS Lambda
triggers to fix things
Custom AWS Config Rules for remediation in AWS.
Lambda
Enable traceability and logging for audit

29. AWS CloudTrail Data Events for S3
Act on API activity immediately in Amazon CloudWatch
Events
• Data Events for Amazon Simple Storage Service (S3)
• Trigger rules that “fix” the problem
• Trace invocations and actions in Amazon CloudWatch
Logs

30. Enforcing Amazon S3 bucket-level security polices

31. POLL
How are you automating your
security on AWS today?

32. Create Policies in code
Assessment and Governance
Fix Violations

33. Deal with Escalations

34. Security Escalations
• Logs, activity data is critical
• Use automation to increase surveillance on suspicious
activity (e.g. AWS CloudTrail is turned off)
• Timely response could be to quarantine
• SOP should be in code!

35. Create Policies in code
Assessment and Governance
Fix Violations
Deal with Escalations

36. Generating Evidence

37. Reports
• Weekly AWS Trusted Advisor reports
• Archived AWS CloudTrail activity in Amazon S3 (never
delete)
• AWS CloudTrail Lookup for 1 week, AWS CloudWatch
Logs for longer term lookup
• AWS Config Snapshot for broad, point-in-time views
• AWS Config GetResourceConfigHistory
>get-resource-config-history --resource-type <value> --resource-id <value> [--later-time <value>] [--earlier-time
<value>]

38. POLL
When did you last run an AWS
Trusted Advisor report?

39. Create Policies in code
Assessment and Governance
Fix Violations
Deal with Escalations
Evidence for Audit

40. Thank you!