This document provides an overview of how to improve AWS security. It discusses common AWS security problems like publicly accessible buckets and stolen credentials. It recommends starting with a consulting company or security tools to audit compliance. The document then reviews the CIS AWS Benchmark for best practices and configurations. It explains how to implement continuous security monitoring versus periodic auditing. AWS security services like CloudTrail, GuardDuty, and SecurityHub are outlined. Best practices architecture and common lessons learned are also recapped. Estimated costs for implementing these security measures on an AWS account are provided.

1. How to stop dreaming
about security and start
implementing
2019 Kromtech

2. Agenda
- AWS Security problems
- Options to start with …
- AWS Security tools
- AWS CIS Implementation
- Q&A

3. Intro & speakers
Aleksandr Maklakov
CIO at ZEO Alliance/Kromtech
14 years in IT
MBA
ISO 27001 Internal Auditor
AWS Certified Solutions Architect - Associate
Nazariy Uniyat
IT Security Engineer at Kromtech
8 years in IT

4. Data breach security trends in cloud
#1 - publicly accessible buckets
#2 - open ports(especially in databases)
#3 - stolen/leaked credentials (access/secret keys) -
cryprominers

5. Options to start with ...
- Find consulting company
- Find some tools for audit and compliance check
- Find framework/controls

6. CIS Amazon Web Services Benchmark
Center for Internet Security (CIS) - nonprofit organization.
Its mission is to "identify, develop, validate, promote, and
sustain best practice solutions for cyber defense and build and
lead communities to enable an environment of trust in
cyberspace"
Recommended for use by many security vendor and PCI DSS

7. CIS Amazon Web Services Benchmark
© Sift Security Inc

8. CIS Amazon Web Services Benchmark

9. Continuous audit vs monitoring
Audit
- Owned by External
Company or Internal
Auditor
- Conduct annually (or
often)
- More formal
Monitoring
- Owned by management
team
- On-going process to
ensure processes are
working as intended
- Easely implement
continuous approach

10. Services

11. CloudTrail

12. AWS Config

15. GuardDuty

17. Macie

22. Security Hub

28. Security Hub Data Sources

29. Enable Them All

31. CloudTrail

36. CloudWatch Logs in Trail

38. AWS Config

46. Aggregator

55. Guard Duty

59. 111111111111

60. Macie

65. 111111111111

67. Security Hub

72. Lessons
- Lambda Logs
- Encryption S3 logs
- SCP policy only for working regions
- Architecture!

73. SUMMARY

74. RECAP
- AWS CIS Benchmark as starting point
- AWS Security Services overview (CloudTrail, Macie,
Guard Duty, SecurityHub, etc)
- Best Practices Architecture
- Lessons & Bugs

75. COST
~ $600/month
~ 200Gb of Logs
~ 17M Events

76. Links
AWS Security Best Practices
AWS CIS Benchmark
AWS CIS Benchmark Quick Start
AWS CloudTrail
AWS Organizations
Amazon GuardDuty
AWS Security Hub

77. Next Steps

78. Incident Management

79. More services
Inspector WAF Shield

80. Q&A