The document discusses various strategies and tools for enhancing security in AWS environments, including the shared responsibility model and infrastructure as code practices with HashiCorp Terraform and Packer. It highlights the importance of secret management with HashiCorp Vault, interservice communication security using TLS, and the use of Web Application Firewalls (WAF) like AWS WAF and NAXSI. Additionally, it mentions AWS services like GuardDuty and Inspector to detect threats and assess security compliance.

1. Battle in the
Clouds: Attacker vs
Defender on AWS
Dani Goland
Mohsan Farid

2. Shared
Responsibility
Model

3. Hummus Bombing Celery Workers

4. Relay 101

5. Exchange Abuse

6. Exchange Abuse

7. Exchange Abuse

8. Exchange Abuse

9. Pivoting isn’t
always easy
but it sho is
fun!

10. Everybody
Wants To Rule
The World

11. Shell Yeah!

12. Lateral-aly

13. Post
Exploitation

14. Post
Exploitation

15. Post
Exploitation

16. Post
Exploitation

17. Post
Exploitation

18. Post
Exploitation

19. Post
Exploitation

21. Infrastructure As Code
(Hashicorp Terraform / AWS Cloudformation)

22. Immutable
Infrastructure(Hashicorp
Packer)
• Bake AMIs with Packer
• Use Ansible to harden the OS
• https://github.com/openstack/ansi
ble-hardening

23. Secret Management
• Hashicorp Vault/AWS SSM
Parameter Store
• Granular control over access
to secrets
• Automatic generation of
short-lived DB
credentials(Vault)

24. Interservice
Communication
• Use TLS
• Manage your own keys via
Vault
• Use Consul Connect sidecar
to automatically proxy your
traffic encrypted.

25. WAF
• AWS WAF Custom Rules or
Managed Rules
• Open Source Solutions Like
NAXSI(with NGINX)
https://github.com/nbs-system/naxsi

26. Example Architecture
• ALB à NGINX(w/ NAXSI) à ECS with Consul Connect Sidecar à Vault

27. AWS Services
Guard Duty – A threat detection
service that continuously monitors
for malicious activity and
unauthorized behavior.
Inspector - An automated security
assessment service that helps
improve the security and compliance
of applications deployed on AWS.

28. VirusBay
Registration Code:
“DEFCON27”