"Transitioning to AWS in a Hurry Without Getting Owned" - Devina Dhawan, Security Engineer at Etsy // @TheUlzo

1. Transitioning to AWS in a
hurry without getting owned
(Hopefully...)
Devina Dhawan
02/06/2017 - Women & Non-Binary Focused intro to AWS
Email: 3@etsy.com
Twitter: @theulzo
1

2. Introduction
2
● Etsy (Jan 2015 - Present)
● Orbitz (May 2014 - Dec 2015)
● University of Illinois in Chicago

3. Etsy operates a global marketplace where people around the world connect,
both online and offline, to make, sell and buy unique goods.
3

4. Security at Etsy
4
● Evangelizing Security at Etsy
○ Candy is a great way to make
friends
○ Allow the conversation about
security to be comfortable
and inviting.

5. What is this talk about?
• I will help you improve your
existing AWS infrastructure
• You will walk away with action
items
• http://bit.ly/2EnZU1q
5

6. “Securing
Amazon Web
Services”
6

7. 7
- Traditional bare metal
- Minimal footprint in the clouds
Infrastructure

8. Where to begin?

9. 9
● Evident.io
○ Scans of
configurations to
see if anything is
misconfigured
● Password policies?
● Multi-factor Authentication
● Jira Tickets
Evident.io

10. 10
Low-hanging IAM Fruit
# Password Policy
# Multi-factor auth
Monitoring
# Cloudtrail Logging
EC2
# Netwerkin’
# EC2 Roles
S3
# S3 Bucket Policies

11. Scout2
● Github Page:
https://github.com/nccgro
up/Scout2
● Reports for all
accounts
● Tie that into alerts
manually

12. 12
Low-hanging IAM
Fruit
# Password Policy
# Multi-factor auth
Monitoring
# Cloudtrail Logging
EC2
# Netwerkin’
# EC2 Roles
S3
# S3 Bucket Policies

13. Changes I made… like a goon
• Password policy to the highest
scrutiny
• Removed all admin roles from
accounts that didn’t need them (aka
hadn’t used aws in 2 yrs and didn’t
have any api keys tied to their user)
13

14. Password Policies

15. My first Etsy communication
Hello X,
Looks like you still do not have MFA set up on your AWS account.
Go ahead and go to Identity & Access Management in your Amazon Web Services console ->
find your username -> Manage MFA Device.
Note: If you no longer need your AWS account, please let me know!
Devina

16. Version 2.0
Hello X,
Looks like you still do not have MFA set up on your AWS
account. It looks like you used your AWS account recently
as well, so please sign up for MFA by 03/31/16 or your
account will be suspended.
Go ahead and go to Identity & Access Management in
your Amazon Web Services console -> find your username
-> Manage MFA Device.
Note: If you no longer need your AWS account, please let
me know!
Your neighborhood candy provider,
Devina

17. Oops...

18. Multiple statements which
allow you to:
● Resync MFA devices
● Deactivate MFA
devices
● List MFA devices
● Primary, management
Other policies:
● Forcing MFA

19. Oof…

20. Aws-cli for account creation
Becoming really used to the aws client is really useful too!

21. Using Terraform for IAM
● What is terraform?
● What can it do?
○ Static creds
○ Environment variables
○ Shared creds
○ EC2 Roles

22. Static Creds

23. 23
Low-hanging IAM Fruit
# Password Policy
# Multi-factor auth
Monitoring
# Cloudtrail Logging
EC2
# Netwerkin’
# EC2 Roles
S3
# S3 Bucket Policies

24. Logging in AWS - Cloudtrail

28. ELK

29. Alert Types
Email:
● Daily Roundup Emails
○ No production impacting
● High Risk Alerts
○ Enough resources to handle
IRC/Slack/Jabber:
● Slack & Dropbox
Collect the alerts:
● Splunk
● 411 / Elastalert

30. 30
Low-hanging IAM Fruit
# Password Policy
# Multi-factor auth
Monitoring
# Scout2
# Logging
EC2
# Netwerkin’
# EC2 Roles
S3
# S3 Bucket Policies

31. Inbound/Outbound

32. EC2 Roles

33. 33
Low-hanging IAM Fruit
# Password Policy
# Multi-factor auth
Monitoring
# Scout2
# Logging
EC2
# Netwerkin’
# EC2 Roles
S3
# S3 Bucket Policies

34. Bucket Policies

37. ● Bug Bounties at Etsy:
https://www.etsy.com/bounty
● S3 Scanner
Github:
https://github.com/bear/s3scan
○ Report of all s3 buckets
and perms
○ Likely how bountiers are
finding out about your
misconfigured policies.

38. 38
So… it happened, what do I do now?
❏ Write down all the systems you need to take care of
❏ Find out what you need to fix on all systems, write that down
❏ Start with the low-hanging fruit
❏ Over communicate what you are doing.
❏ Work with networking on the AWS network
❏ Create default rulesets & roles
❏ Work with IT/helpdesk to handle account provisioning
❏ Work with systems engineering to handle provisioning of
services
❏ … profit?

39. THANKS!
3@etsy.com
@theulzo