AWS Security Week: Threat Detection & Remediation Workshop

© 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.© 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Jesse Fuchs, Security Solutions Architect
August 2018
Threat Detection and
Remediation Workshop

© 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Workshop Agenda
• Quick introduction to the workshop
• Module 1: Environment build and configuration (20 min)
• Run CloudFormation template and some setup
• Module 2: Attack simulation (and presentation) (40 min)
• Run CloudFormation template
• Presentation and live role playing exercise
• Module 3: Detection and remediation (45 min)
• Investigate the attack
• Module 4: Review and discussion (15 min)
• Presentation / group Q&A
• Cleanup

Verizon Report
https://www.verizonenterprise.com/resources/reports/rp_DBIR_2018_Report_en_xg.pdf
Verizon - Data Breach Investigations Report
Data Breach Patterns

Workload XYZ
What could
possibly go
wrong here?

Module 1
Environment Build and Configuration

Start Module 1
https://tinyurl.com/y84cc3pj
(https://github.com/aws-samples/aws-security-workshops/tree/master/threat-detection-wksp)
Directions:
• Browse to https://tinyurl.com/y84cc3pj
• Read through the workshop scenario
• Click on Environment Build and Configuration at the end
• Complete module (~15 min) then stop
• We will later start module 2 and do a presentation
use
us-west-2

Module 2
Attack Simulation and Presentation

Module 2 Agenda
• Run the CloudFormation template (~5 min)
• Threat detection and remediation presentation (~20 min)
• Live role playing demo (~10 min)
• Environment walkthrough (~10 min)

Start Module 2
Directions:
• Click on Attack Simulation at the end
• Complete this module (~5 min) then stop
• We will then do a presentation
use
us-west-2

Threat Detection and Remediation Intro

Why is threat detection so hard?
Skills shortageSignal to noiseLarge datasets

Get humans away from the data and analysis
AWS CISO Stephen Schmidt, at re:Invent 2017: “It's people who make mistakes, it's people who have good
intentions but get phished, it's people who use the same credentials in multiple locations and don't use a
hardware token for a multi-factor authentication… Get the humans away from the data.”

Detecting breaches
https://www.verizonenterprise.com/resources/reports/rp_DBIR_2018_Report_en_xg.pdf

Top Actions Taken to Address Security Issues
Source: 2017 Forbes Insights – “Enterprises Reengineer Security in the Age of Digital Transformation”
2017 Forbes Insights –
“Enterprises Reengineer
Security in the Age of
Digital Transformation”

AWS CloudTrail
AWS Config Rules
Amazon
CloudWatch Logs
Amazon GuardDuty
VPC Flow Logs
Amazon Macie
AWS Shield
AWS WAF
AWS
Systems Manager
Amazon Inspector
VPC
KMS
AWS CloudHSM
IAM
AWS Organizations
AWS Cognito
AWS Directory Service
AWS Single Sign-On
Certificate Manager
Amazon Inspector
AWS Config Rules
AWS Lambda
AWS
Systems Manager
Amazon
CloudWatch Events
Pro Services Raptor
Protect RespondDetect RecoverIdentify
AWS Lambda
AWS DR and Backup
Solutions
AWS
Systems Manager
AWS Config
AWS Security Solutions https://www.nist.gov/cyberframework

GDPR and threat detection & remediation
Under GDPR, Controllers and Processors are required to implement
appropriate Technical and Organizational Measures (“TOMs”)
(1) Pseudonymisation and
encryption of personal data
(2) Ensure ongoing confidentiality,
integrity, availability, and
resilience of processing systems
and services
(3) Ability to restore availability
and access to personal data in a
timely manner in the event of a
physical or technical incident
(4) Process for regularly testing,
assessing, and evaluating the
effectiveness of TOMs

Threat Detection Services

Threat Detection: Log Data Inputs
AWS CloudTrail VPC Flow Logs CloudWatch Logs DNS Logs
Track user
activity and API
usage
IP traffic to/from
network interfaces
in your VPC
Monitor apps using
log data, store &
access log files
Log of DNS queries
in a VPC when
using the VPC DNS
resolver

Threat Detection: Machine Learning
Amazon
GuardDuty
Intelligent threat detection
and continuous monitoring
to protect your AWS
accounts and workloads
Amazon Macie
Machine learning-powered
security service to discover,
classify & protect sensitive data

Threat Detection: Evocations/Triggers
Amazon CloudWatch
Events
Delivers a near real-time stream
of system events that describe
changes in AWS resources
AWS Config rules
Continuously tracks your
resource configuration changes
and if they violate any of the
conditions in your rules

Amazon CloudWatch Events
{
"source": [
"aws.guardduty"
]
}
CloudWatch
Event
GuardDuty
findings
Lambda
function

Threat Remediation Services

Threat Remediation Services
AWS Systems
Manager
AWS
Lambda
Amazon
Inspector
Run code for virtually
any kind of application
or backend service –
zero administration
Gain operational
insights and take
action on AWS
resources
Automate security
assessments of EC2
instances

High-Level Playbook
Adversary Your
environment
Lambda
function
CloudWatch
Events

High-Level Playbook
Amazon
CloudWatch
Events
AWS
CloudTrail
AWS Config
Lambda
function
AWS
APIs
Detection
Alerting
Remediation
Countermeasures
Forensics
Team
collaboration
(Slack etc.)
Amazon
GuardDuty
VPC Flow Logs
Amazon
Inspector

Live Role Playing Demo

Environment Walkthrough

Review Questions
• How can you create custom rules for Config?
• How do GuardDuty and Macie differ when it comes to CloudTrail analysis?
• What services are important for automation of remediations?
• What performance impact does GuardDuty have on your account if you
have more then 100 VPCs?
• Which of the services discussed have direct access to your EC2 Instances?

Module 3
Detection and Remediation

Start Module 3
Directions:
• Click on Detection & Remediation at the end
• Run through this module (~45 min)
• We will then finish up with module 4 and cleanup
use
us-west-2

Module 4
Review, Discussion, & Cleanup

The Attack

The Setup

The Simulation

Workshop Questions

Question 1
Why did the AWS API calls from the “malicious
host” generate GuardDuty findings?

Question 2
How many unique AWS API calls were made from
the “malicious host” and how did you identify the
them?

Question 3
The lab mentions you can ignore the high severity
SSH brute force attack finding.
Why can you ignore it and how is it different from
the low severity brute force finding?

Question 4
What type of server-side encryption was used to
encrypt the objects in the data bucket?
Would Macie be able to classify the objects if you
were to use SSE-KMS?

Question 5
Macie had an alert for “S3 Bucket IAM policy
grants global read rights.” We investigated that
bucket in the workshop. Were the objects in the
bucket actually publicly accessible?
If the public had a policy that allowed for global
read right, would the encrypted objects be
accessible?

Thanks!

AWS Security Week: Threat Detection & Remediation Workshop

Recommended

Recommended

More Related Content

What's hot

What's hot (20)

Similar to AWS Security Week: Threat Detection & Remediation Workshop

Similar to AWS Security Week: Threat Detection & Remediation Workshop (20)

More from Amazon Web Services

More from Amazon Web Services (20)

AWS Security Week: Threat Detection & Remediation Workshop