Security Essentials For Startups Taking Their First Steps As Cloud Providers. This deck is based on the the below paper: https://chapters.cloudsecurityalliance.org/israel/papers/

2. Why am I here?

3. } Background
} Application Security
} Platform Security
} Security Management

4. To help wish we
Ourselves

5. Security as you evolve
Intrusiveness
Type of data collected
Sector (Fin, Gov)
SU maturity
OS PII

7. Security by Design
• Spoofing identity
• Tampering with data
• Repudiation
• Information disclosure
• Denial of service
• Elevation of privilege

8. Authentication & Authorization

9. Application Security
Eitan Satmary, Security Architect @Wix
eitans@wix.com

10. ✔ Secure
hosting
✔ SEO
✔ 24/7 Support
Easy drag and drop
Designer-made templates
Beautiful galleries, mobile optimized,
domains, huge image collection
1 2
Everything you need to create your FREE stunning website
People from every type of business & profession imaginable.
Musicians, Online store owners, Designers, Dentists, Dog walkers, Bloggers, Photographers, Lawyers, and more…

11. 1
1
Over 102 millions
users
in 180 countries
Over 250 Apps
Over 550
Templates
Offices in 8 countries
Business
Partner
1400
Employees
500
Developers
Over 2.5 PByte
User’s media files
Over 1000 servers
In 3 datacenters
2 Clouds
(Amazon &
Google)

12. Security Challenges
★ More than 2 billions
requests per day
★ above 400 micro services
★ 1,300 deployments a
month (totally Agile)
★ We’re always on
★ 5 main programming
languages
★ Platform abuse - targeted
for malicious activity

13. Security at Wix
FED
Server
Product
Security
Cross-engineering teams
11 in Security team
IT and Production
Security
champion in
every company
Security forum every 2 weeks
from legal, marketing, HR, BI and more
Security in all
company’s
departments

14. What I would do
if I would start from scratch
★ You’re a new startup
★ Security products cost
money, maintenance and
training
★ You want top value for
your efforts
321
Follow this 3-steps workflow

15. 321
step 1
Implement security
best practices in SDLC
★ Authentication
★ Authorization
★ Password policy
★ Session management
★ Error handling
★ Storing sensitive data
★ Input validation
★ Secured queries
★ Logs
★ More...

16. 321
step 1
Implement security
best practices in SDLC
For every new big feature:
analyze threat models by STRIDE
Threat Mitigation
Spoofing Authentication
Tampering Integrity
Repudiation Nonrepudiation
Information disclosure Confidentiality
Denial of Service Availability
Elevation of Privileges Authorization

17. step 2
How certificates
can help you
1. They enforce order and
procedures
2. You’ll have something to show
your customers
PCI
ISO 27001 ISO 27018
321

18. step 2
Implement security
best practices in SDLC
Internal and external
Penetration Tests
Define vectors that disturb the flow
★ Can I crash the site / data?
★ Can I steal information?
★ Can I access users’ PII?
★ Can I disconnect the data?
321

19. step 2
Implement security
best practices in SDLC
Use your BI data!
Configure alerts for abnormalities of user actions
Deliver dedicated security trainings
★ For frontend developers
★ For server developers
★ For mobile developers
★ For QA
★ For Support
321

20. 321
step 3
Now you can
buy products
WAF
Bug bounty
DB FW
Static & dynamic code
analysis

21. Eitan Satmary, Security Architect @Wix
eitans@wix.com

23. Shared responsibility

24. Management dashboard

25. Backend
• Network segregation
• Red/Black push
• Encryption
• Physical security

26. Platform Security
Marius Aharonovich
Cloud Security Architect
ClickSoftware

27. } Platform Security
} Management
} Secure API keys
} Increase Your Visibility
} Host Security
} Encryption and Key Management

28. Platform Security
Security Best Practices checklist:
CIS AWS AZURE GOOGLE
Cloud Platform
AWS Infrastructure
Management Services
EC2
Instance
3rd party

29. Management
Amazon Web Services
Root
Limited use
Support plan
Payment
Close account
Request PenTest
Two-Factor-Authentication
TOTP enabled virtual TFA
Google
authenticator
Authy
IAM Users
Two-Factor-
Authentication
User Groups
DevOps, NOC,
R&D Lead, DBA,
Security
IAM Policies
"Effect":
"Allow",
"Action":
"s3:ListBucket
", "Resource":
"arn:aws:s3:::
example_bucket
"
Services
Resource
Based Policies
" “Effect":
"Deny",
Principal":
"*",
"Action":
"s3:*",
Resource":
"arn:aws:s3:::
example
Condition":
{“BoolIfExists
":{
"aws:MultiFact
orAuthPresent"
: false
Cross
Account
Effect":
"Allow",
"Principal": {
"AWS":
"arn:aws:iam::
AccountID"},
"Action":
"sts:
AssumeRole",
"Condition": {
"StringEquals"
: {
"sts:
ExternalId":
“IAMUSerID"

30. Services – Secure API keys
Use temporary
keys (STS)
Don't embed API
keys directly
into code
Rotate API keys
periodically
Delete unused
API keys
Use unique API
keys for
applications

31. Increase Your Visibility
AWS
EC2CloudTrail
Dashboard APIs
CASB
Access
& Activities
Trusted
Advisor
Credentials
Report
IAM User
“List Events”
Cloud Security Control
SG Changes & Risk & Compliance
Forensics traffic layers 3/4
Web traffic analysis
IAM Cross
Account Role
“List
Configuration”
IAM Cross
Account Role
“IP Traffic”
logC
VPC
Flow-Log
logC
S3
logC
Other
Cloud Services
logC
Service User
“List Events”
Infrastructure
EC2
Instance
logC
Load Balancer
logC
Web Traffic
(syslog)
Log Collector
Security event alerting
Security reports
Forensics
Domain Auditor
Domain changes reporting
Forensics
EventsDomain
Config
Web Traffic
(syslog)

32. Host Security
VPN Gateway
Two-Factor-
Authentication
Encrypted
TLS
Patch Hosts
WSUS
Systems
Manager
New
Deployed
AMI
DoS Protection
AWS Shield
Basic Advanced
3rd party
solution
SIEM
Access
& Activities
Infra
Changes
Analysis
Firewall
Inbound
&
outbound
rules
Security
Groups
3rd party
Harden Hosts
(CIS)
User groups
& Permissions
Antimalware
& HIPS
Scan Hosts
3rd party
Vulnerabilities

33. Encryption and Key Management
Why to Encrypt ?
Contracts Regulations Standards
Data in Transit
TLSv1.2
AES-256bit
GCM
ELB
ALB
CloudFront
3rd party
Certificate
Manager
Data at Rest
Storage / Volume
Encryption
EBS
Encryption
RDS
Storage
Encryption
KMS
Data Backup
Encryption
SQL Backup
Encryption
RDS
Snapshot
Encryption
KMS
HSM
FIPS 140-2 Level 2 FIPS 140-2 Level 3

35. Security Management
Gilad Yaron, Head of Cybersecurity Strategy & Cloud Services, SECOZ
cybersecurity center, BDO

36. 36
Our goal is to maintain the agile pace of
development, while introducing security in ways
that accommodate simple and efficient
processes.
We find alternatives that are sufficient to get

38. 38

39. 39

40. 40

41. 41

42. 42

43. Security Management
Shahar Maor, Information Security Manager,
Outbrain

44. 3 6200 120 500M 250B

47. Discovery:
• So many options, so many providers…
• Manual on/off-boarding
• Long tail apps, Chrome ext.
Control:
• Multiple passwords, app-specific password
• Collaboration is open by design

49. MMMMMM….
Active Directory

50. Corporate
Privacy and Compliance
Anti-Fraud
Platform
RnD and Products

51. Core
systems
SSO
Other
external
services
Production
Data centers
51

53. Awareness and Education
5
3
On-Boarding
Company
Communications
Awareness
Campaigns:
Phishing&SE
5
3
Information Security

54. Suspicious
email
Malware DetectedNo Malware Detected
FWD to: xxx@outbrain.com
Analyzing
the message
Scan links &
attachments
Harness the
power of 56
file scanners
and 67 link
scanners!
5
4
Information Security
Beta: Phishing and Virus analyzer

56. Cloud Security
• So many options, so many providers…
• Manual on/off-boarding
• Long tail apps, Chrome ext.
• Multiple passwords, app-specific password
• Collaboration is open by design

57. Solutions
• Narrow down choices (Box, Google Drive)
• Education
• Formal tool selection
• Education
• SSO+2FA
• Education
• CASB
• Education

58. “TRYING ISTHE FIRST STEP
TOWARDS FAILURE”
H. Simpson