"In this session, learn how Trend Micro built Deep Security as a service on AWS. This service offers enterprise-grade security controls for AWS deployments in the form of intrusion detection and prevention, anti-malware, a firewall, web reputation, and integrity monitoring. With over 400 internal requirements set by their in-house Information Security and IT Operations teams, the Service team was challenged with building the case to deploy Deep Security as a service on AWS instead of in-house. This session walks through the reasons why the team chose AWS, the design decisions they made, and how they were able to meet or exceed their in-house requirements while deploying on AWS."

1. Learn How Trend Micro Used AWS to
Build their Enterprise Security Offering
(Deep Security as a Service)
Mark Nunnikhoven, Principal Engineer at Trend Micro
November 14, 2013
© 2013 Amazon.com, Inc. and its affiliates. All rights reserved. May not be copied, modified, or distributed in whole or in part without the express consent of Amazon.com, Inc.
Friday, November 15, 13

2. "The following story is fictional and does
not depict any actual person or event"
Friday, November 15, 13

3. "The following story is completely real and
depicts actual people & events"
* Only the names have been changes to protect the innocent ;-)
Friday, November 15, 13

4. The stage
Friday, November 15, 13

5. What is Deep Security?
Centralized security control management
Friday, November 15, 13

6. What is Deep Security?
Centralized security control management
Manager
Friday, November 15, 13

7. What is Deep Security?
Centralized security control management
Manager
Friday, November 15, 13
Agent

8. What could be...
Friday, November 15, 13

9. What could be...
•
Friday, November 15, 13
For the cloud

10. What could be...
For the cloud
• In the cloud
•
Friday, November 15, 13

11. What was
Determine what an
appropriate visual here would
be (old style for contrast?)
Friday, November 15, 13

12. What was
•
Determine what an
appropriate visual here would
be (old style for contrast?)
Friday, November 15, 13
For the data center

13. What was
For the data center
• In the data center
•
Determine what an
appropriate visual here would
be (old style for contrast?)
Friday, November 15, 13

14. The story so far...
Friday, November 15, 13

15. Deep Security—The Early Years
Security for servers and virtual machines
Friday, November 15, 13

16. Deep Security—The Early Years
Security for servers and virtual machines
Product focus
•
Enterprise only
•
Tight integration with virtualization platform
•
Focused on Windows platforms
Friday, November 15, 13

17. Deep Security—The Middle Years
Security for servers and virtual machines
Friday, November 15, 13

18. Deep Security—The Middle Years
Security for servers and virtual machines
Big changes
•
Acquired by Trend Micro in 2009
•
Provided more protection
•
Agentless protection is key
•
Expanded platform support
Friday, November 15, 13

19. Deep Security—Now
Friday, November 15, 13

20. Deep Security—Now
Product changes
•
Protection regardless of location
•
“Single pane of glass”
•
Smart, simple, security that fits taken to heart
Friday, November 15, 13

21. Deep Security—Now
Security for servers, virtual machines
Product changes
•
Protection regardless of location
•
“Single pane of glass”
•
Smart, simple, security that fits taken to heart
Friday, November 15, 13

22. Deep Security—Now
Security for servers, virtual machines, & the cloud
Product changes
•
Protection regardless of location
•
“Single pane of glass”
•
Smart, simple, security that fits taken to heart
Friday, November 15, 13

23. The Decision
Time to offer Deep Security as a service
Friday, November 15, 13

24. Why a Service?
Security for servers, virtual machines
Friday, November 15, 13

25. Why a Service?
Security for servers, virtual machines
Drivers
•
Face the same challenges as our clients
Friday, November 15, 13

26. Why a Service?
Security for servers, virtual machines
Drivers
•
Face the same challenges as our clients
•
Work directly with clients
Friday, November 15, 13

27. Why a Service?
Security for servers, virtual machines
Drivers
•
Face the same challenges as our clients
•
Work directly with clients
•
Smaller feedback loop for new features
Friday, November 15, 13

28. The players
Friday, November 15, 13

29. Internal Teams
Friday, November 15, 13

30. Internal Teams
The Service Team
Executive sponsor
Key R&D product team
members
DevOps*
Friday, November 15, 13

31. Internal Teams
The Service Team
Executive sponsor
Key R&D product team
members
DevOps*
Friday, November 15, 13

32. Internal Teams
The Service Team
Executive sponsor
Key R&D product team
members
DevOps*
People to win over
Executives
Information Security
Operations
R&D Product Team
Friday, November 15, 13

33. Internal Teams
The Service Team
Executive sponsor
Key R&D product team
members
DevOps*
vs
People to win over
Executives
Information Security
Operations
R&D Product Team
Friday, November 15, 13

34. Internal Teams
The Service Team
Executive sponsor
Key R&D product team
members
DevOps*
vs
People to win over
Executives
Information Security
Operations
R&D Product Team
Friday, November 15, 13

35. Internal Teams
The Service Team
Executive sponsor
Key R&D product team
members
DevOps*
Friday, November 15, 13
+
People who helped
Executives
Information Security
Operations
R&D Product Team

36. Internal Teams
The Service Team
Executive sponsor
Key R&D product team
members
DevOps*
Friday, November 15, 13
+
People who helped
Executives
Information Security
Operations
R&D Product Team

37. Team Profile
Information Security
•
Own existing security policy
Friday, November 15, 13

38. Friday, November 15, 13

39. Team Profile
Information Security
•
Own existing security policy
Friday, November 15, 13

40. Team Profile
Information Security
•
Own existing security policy
•
400+ requirements for operational services
Friday, November 15, 13

41. Team Profile
Information Security
•
Own existing security policy
•
400+ requirements for operational services
•
Wants development of cloud best practices
Friday, November 15, 13

42. Team Profile
Operations
•
Run several data centers worldwide
Friday, November 15, 13

43. Team Profile
Operations
•
Run several data centers worldwide
•
Rigid change management with complex schedules
Friday, November 15, 13

44. Team Profile
Operations
•
Run several data centers worldwide
•
Rigid change management with complex schedules
•
Wants development of DevOps runbook
Friday, November 15, 13

45. Team Profile
R&D Product Team
•
Develop & maintain the product
Friday, November 15, 13

46. Team Profile
R&D Product Team
•
Develop & maintain the product
•
Only operational work is emergency support
Friday, November 15, 13

47. Team Profile
R&D Product Team
•
Develop & maintain the product
•
Only operational work is emergency support
•
Wants tighter feedback loop
Friday, November 15, 13

48. The details
Friday, November 15, 13

49. High Level Architecture
Friday, November 15, 13

50. High Level Architecture
Agent
Friday, November 15, 13

51. High Level Architecture
Agent
Friday, November 15, 13

52. High Level Architecture
Agent
Friday, November 15, 13
Load
Balancer

53. High Level Architecture
Agent
Friday, November 15, 13
Load
Balancer
Manager
+ Relay

54. High Level Architecture
Agent
Friday, November 15, 13
Load
Balancer
Manager
+ Relay
Database

55. High Level Architecture
Bi-direction communications
Agent
Friday, November 15, 13
Load
Balancer
Manager
+ Relay
Database

56. Load balancers
Friday, November 15, 13

57. High Level Architecture
Friday, November 15, 13

58. High Level Architecture
Agent
Friday, November 15, 13

59. High Level Architecture
Agent
Friday, November 15, 13

60. High Level Architecture
Agent
Friday, November 15, 13
Load
Balancer

61. High Level Architecture
Agent
Friday, November 15, 13
Load
Balancer
Manager
+ Relay

62. High Level Architecture
Agent
Friday, November 15, 13
Load
Balancer
Manager
+ Relay
Database

63. High Level Architecture
Bi-direction communications
Agent
Friday, November 15, 13
Load
Balancer
Manager
+ Relay
Database

64. Load Balancers
Friday, November 15, 13

65. Load Balancers
Requirements
•
3 flows, all incoming on :443
Friday, November 15, 13

66. Load Balancers
Requirements
•
3 flows, all incoming on :443
•
SSL off loading
Friday, November 15, 13

67. Load Balancers
Requirements
•
3 flows, all incoming on :443
•
SSL off loading
•
High number of concurrent connections
Friday, November 15, 13

68. Load Balancers
HAProxy
Met requirements
2+ instances required (for HA)
EC2 instance costs
More boxes to maintain
Friday, November 15, 13

69. Load Balancers
HAProxy
Elastic Load Balancing
Met requirements
Can meet requirements
2+ instances required (for HA)
3 load balancers required (1x
flow)
EC2 instance costs
More boxes to maintain
Cheap
Minimal maintenance
Friday, November 15, 13

70. Load Balancer Architecture
Fix
Load
Balancer
Friday, November 15, 13

71. Load Balancer Architecture
Fix
Agent
Friday, November 15, 13
Load
Balancer

72. Load Balancer Architecture
Fix
Agent
Friday, November 15, 13
Load
Balancer

73. Load Balancer Architecture
Fix
Agent
Friday, November 15, 13
Load
Balancer
Manager
+ Relay

74. Load Balancer Architecture
Fix
Agent
Friday, November 15, 13
Load
Balancer
Manager
+ Relay
Database

75. Load Balancer Architecture
Bi-direction communications
Fix
Agent
Friday, November 15, 13
Load
Balancer
Manager
+ Relay
Database

76. Manager + Relay
Friday, November 15, 13

77. High Level Architecture
Load
Balancer
Friday, November 15, 13

78. High Level Architecture
Agent
Friday, November 15, 13
Load
Balancer

79. High Level Architecture
Agent
Friday, November 15, 13
Load
Balancer

80. High Level Architecture
Agent
Friday, November 15, 13
Load
Balancer
Manager
+ Relay

81. High Level Architecture
Agent
Friday, November 15, 13
Load
Balancer
Manager
+ Relay
Database

82. High Level Architecture
Bi-direction communications
Agent
Friday, November 15, 13
Load
Balancer
Manager
+ Relay
Database

83. Manager + Relay
Friday, November 15, 13

84. Manager + Relay
Requirements
•
Hosts JVM-based application
Friday, November 15, 13

85. Manager + Relay
Requirements
•
Hosts JVM-based application
•
Memory, CPU, and network are constraints
Friday, November 15, 13

86. Manager + Relay
AWS Windows Base
Met requirements
Harder to script
More expensive
Friday, November 15, 13

87. Manager + Relay
AWS Windows Base
AWS Linux Base
Met requirements
Met requirements
Harder to script
Simple scripting
More expensive
Cheaper
Friday, November 15, 13

88. Manager + Relay Architecture
Fix
Load
Balancer
Friday, November 15, 13

89. Manager + Relay Architecture
Fix
Agent
Friday, November 15, 13
Load
Balancer

90. Manager + Relay Architecture
Fix
Agent
Friday, November 15, 13
Load
Balancer

91. Manager + Relay Architecture
Fix
Agent
Friday, November 15, 13
Load
Balancer
Manager
+ Relay

92. Manager + Relay Architecture
Fix
Agent
Friday, November 15, 13
Load
Balancer
Manager
+ Relay
Database

93. Manager + Relay Architecture
Bi-direction communications
Fix
Agent
Friday, November 15, 13
Load
Balancer
Manager
+ Relay
Database

94. Manager + Relay—Tips & Tricks
Friday, November 15, 13

95. Manager + Relay—Tips & Tricks
Tips & tricks
•
We don’t use AMIs
Friday, November 15, 13

96. Manager + Relay—Tips & Tricks
Tips & tricks
•
We don’t use AMIs
•
Auto-scale only for failover
Friday, November 15, 13

97. Database
Friday, November 15, 13

98. High Level Architecture
Load
Balancer
Friday, November 15, 13
Manager
+ Relay

99. High Level Architecture
Agent
Friday, November 15, 13
Load
Balancer
Manager
+ Relay

100. High Level Architecture
Agent
Friday, November 15, 13
Load
Balancer
Manager
+ Relay

101. High Level Architecture
Agent
Friday, November 15, 13
Load
Balancer
Manager
+ Relay
Database

102. High Level Architecture
Bi-direction communications
Agent
Friday, November 15, 13
Load
Balancer
Manager
+ Relay
Database

103. Database
Friday, November 15, 13

104. Database
Requirements
•
MS SQL or Oracle
Friday, November 15, 13

105. Database
Requirements
•
MS SQL or Oracle
•
Low latency path to Manager + Relay nodes
Friday, November 15, 13

106. Manager + Relay
on Amazon EC2
Met requirements
2x cost for clustered pairs
More maintenance
Friday, November 15, 13

107. Manager + Relay
on Amazon EC2
on Amazon RDS
Met requirements
Can meet requirements
2x cost for clustered pairs
1.3x cost for clustered pairs
More maintenance
Less effort
Friday, November 15, 13

108. Manager + Relay
MS SQL
Teams are more familiar
Better tools available*
30 DB limit per Amazon RDS
instance
Friday, November 15, 13

109. Manager + Relay
MS SQL
Oracle
Teams are more familiar
Forces product improvements
Better tools available*
“Encourages” learning
30 DB limit per Amazon RDS
instance
No tablespace limits
Friday, November 15, 13

110. Database Architecture
Fix
Load
Balancer
Friday, November 15, 13
Manager
+ Relay

111. Database Architecture
Fix
Agent
Friday, November 15, 13
Load
Balancer
Manager
+ Relay

112. Database Architecture
Fix
Agent
Friday, November 15, 13
Load
Balancer
Manager
+ Relay

113. Database Architecture
Fix
Agent
Friday, November 15, 13
Load
Balancer
Manager
+ Relay
Database

114. Database Architecture
Bi-direction communications
Fix
Agent
Friday, November 15, 13
Load
Balancer
Manager
+ Relay
Database

115. Final(ish) Design
Friday, November 15, 13

116. High Level Architecture
Agent
Friday, November 15, 13
Load
Balancer
Manager
+ Relay
Database

117. High Level Architecture
Agent
Friday, November 15, 13
Load
Balancer
Manager
+ Relay
Database

118. High Level Architecture
Bi-direction communications
Agent
Friday, November 15, 13
Load
Balancer
Manager
+ Relay
Database

119. High Level Architecture
Add highly detailed graphic
here
Agent
Friday, November 15, 13
Load
Balancer
Manager
+ Relay
Database

120. High Level Architecture
Add highly detailed graphic
here
Agent
Friday, November 15, 13
Load
Balancer
Manager
+ Relay
Database

121. High Level Architecture
Add highly detailed graphic
here
Bi-direction communications
Agent
Friday, November 15, 13
Load
Balancer
Manager
+ Relay
Database

122. Supporting Services
Friday, November 15, 13

123. Supporting Services
Amazon Route 53 for all
DNS
Friday, November 15, 13

124. Supporting Services
Amazon S3 for
deployment storage
Friday, November 15, 13

125. Supporting Services
Change graphic
AWS Trusted Advisor for
sanity checks
Friday, November 15, 13

126. Supporting Services
Change graphic
Premium Support for CYA
Friday, November 15, 13

127. “Soft” (not easy) changes
Friday, November 15, 13

128. Team Profile
Validating lessons for the
team
Information Security
•
Own existing security policy
Friday, November 15, 13

129. Team Profile
Validating lessons for the
team
Information Security
•
Own existing security policy
•
400+ requirements for operational services
Friday, November 15, 13

130. Team Profile
Validating lessons for the
team
Information Security
•
Own existing security policy
•
400+ requirements for operational services
•
Wants development of cloud best practices
Friday, November 15, 13

131. Team Profile
Validating lessons for the
team
Operations
•
Run several data centers worldwide
Friday, November 15, 13

132. Team Profile
Validating lessons for the
team
Operations
•
Run several data centers worldwide
•
Rigid change management with complex schedules
Friday, November 15, 13

133. Team Profile
Validating lessons for the
team
Operations
•
Run several data centers worldwide
•
Rigid change management with complex schedules
•
Wants development of DevOps runbook
Friday, November 15, 13

134. Chart Example
Region 1
Region 2
2007
Add stats for Service
2008
Add goals for other Trend
services
2009
2010
0
Friday, November 15, 13
25
50
75
100

135. Team Profile
Validating lessons for the
team
R&D Product Team
•
Develop & maintain the product
Friday, November 15, 13

136. Team Profile
Validating lessons for the
team
R&D Product Team
•
Develop & maintain the product
•
Only operational work is emergency support
Friday, November 15, 13

137. Team Profile
Validating lessons for the
team
R&D Product Team
•
Develop & maintain the product
•
Only operational work is emergency support
•
Wants tighter feedback loop
Friday, November 15, 13

138. Chart Example
Region 1
Region 2
2007
Add bug/feature stats
2008
2009
2010
0
Friday, November 15, 13
25
50
75
100

139. Team Profile
Validating lessons for the
team
Service Team
•
Own existing security policy
Friday, November 15, 13

140. Team Profile
Validating lessons for the
team
Service Team
•
Own existing security policy
•
400+ requirements for operational services
Friday, November 15, 13

141. Team Profile
Validating lessons for the
team
Service Team
•
Own existing security policy
•
400+ requirements for operational services
•
Wants development of cloud best practices
Friday, November 15, 13

142. Chart Example
Region 1
Region 2
2007
Add stats for support?
2008
2009
2010
0
Friday, November 15, 13
25
50
75
100

143. Well?
Friday, November 15, 13

144. Why a Service?
Security for servers, virtual machines
Friday, November 15, 13

145. Why a Service?
Security for servers, virtual machines
Drivers
•
Face the same challenges as our clients
Friday, November 15, 13

146. Why a Service?
Security for servers, virtual machines
Drivers
•
Face the same challenges as our clients
•
Work directly with clients
Friday, November 15, 13

147. Why a Service?
Security for servers, virtual machines
Drivers
•
Face the same challenges as our clients
•
Work directly with clients
•
Smaller feedback loop for new features
Friday, November 15, 13

148. Please give us your feedback on this
presentation
SEC307
As a thank you, we will select prize
winners daily for completed surveys!
Friday, November 15, 13
Thank You