After AWS IAM and detective controls, the afternoon at AWS Security Week turns to infrastructure security, which means tuning AWS service configurations, AMI composition, and hardening other digital assets that will be deployed. You will learn how to define networking architecture (VPCs, subnets, security groups); how to develop hardened AMIs based on your requirements; the importance of defining Internet ingress and egress flows; and how to determine vulnerability management and operational maintenance cadence. Speaker: Mike Wasielewski - Sr. Solutions Architect, AWS

1. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved
CAF Infrastructure Security: Your minimum security
baseline

2. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved
Infrastructure Security
• Least Privilege
• Infrastructure Security
• Virtual Private Cloud (VPC)
• AWS Shield / WAF
• Firewall manager
• Endpoint Security
• AMI Build
• Inspector
• EC2 Systems Manager (SSM)
• Quick starts
• APN Solutions

3. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved
Least privilege
• Only the permissions required to perform the function
• Apply at various layers (App, Endpoint, Infra)
• User accounts
– Only give admin if required
• Security groups/NACLS
– Only allow ports that are necessary to the function
– Only allow connections that have a business need
• EC2 instances
– Only run services necessary
– Do not run more than one function/service

4. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved
Virtual Private Cloud (VPC)
• Internet Gateway
• Nat Gateway
• VPN
• Direct Connect
• VPC peering

5. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved
Virtual Private Cloud (VPC)
Boundary Defense
• Control inbound and
outbound access to VPC,
instances and subnets
• Route Tables
• Network Access Control List
• Security Groups

6. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved
Security Groups / Network ACL Comparison
Security Group Network ACL
Operates at the instance level Operates at the subnet level
Supports allow rules only Supports allow rules and deny rules
Stateful: Return traffic is automatically
allowed, regardless of any rules
Stateless: Return traffic must be explicitly
allowed by rules
We evaluate all rules before deciding whether
to allow traffic
We process rules in number order when
deciding whether to allow traffic
Applies to an instance only if the security
group is specified
Automatically applies to all instances in the
subnets

7. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved
AWS WAF
Web traffic filtering
with custom rules
Malicious request
blocking
Active monitoring &
tuning
• Detect and filter malicious web requests

8. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved
AWS WAF: Sample requests
• Add a count action to analyze
details of matching requests:
Client IP
Country
Headers
HTTP
Version
Method
URI

9. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved
Web Application Firewall (WAF)
• Blue prints
– WAF automation
– OWASP top 10
• Create your own rules
• AWS marketplace rulesets
https://aws.amazon.com/answers/se
curity/aws-waf-security-
automations/
https://aws.amazon.com/about-
aws/whats-new/2017/07/use-aws-
waf-to-mitigate-owasps-top-10-web-
application-vulnerabilities/

10. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved
Market place rule sets
• Protection against new and emerging threats
• Security research teams monitor, tune, and
– update rules regularly
• Rule updates happen within minutes
• No extra cost for updates
• Unsubscribe anytime

11. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved
AWS Shield
Managed DDoS Protection
• Shield Standard for All
• Protect from common
attack
– Layer 3 & 4
– SYN/ACK
– UDP Flood
– Reflection
• Add WAF for Layer 7
• Shield Advanced ($)
– Sophisticated attacks
– Access to DDoS Team
– Cost protection
Amazon
Route 53
CloudFront
users
security group (BuildABeer-SG-1)
Public subnet
servers
Private subnet
ELB

12. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved
AWS Firewall Manager
Centrally manage AWS
WAF rules across
account
Integrated with
Managed Rules for AWS
WAF
Ensure
compliance of
rules across your
organization

13. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved
AWS Firewall Manager
Set the master
AWS Account
Specify policy
scope
Create policyCreate custom
RuleGroup
or use Managed Rules
from AWS Marketplace

14. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved
Egress Control
Controlling traffic flows
• In addition to Security Groups,
NACLs & Routes
• VPC endpoints
• NAT gateways
• Inline Gateways
• DLP
• IDS
• App Filtering
• Host Tools
• DLP
• IDS
• FIM

15. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved
• VPC Endpoint: Gateway
• Gateway
– Access supported AWS
services without going to
internet
• Amazon S3
• DynamoDB

16. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved
VPC Endpoint: Interface
PrivateLink
• Access AWS & Partner
services without going to
Internet
• Create private endpoints
for services you provide
• Marketplace has SaaS
products available that use
PrivateLink

17. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved
Network Address Translation (NAT)
• 2 types: Gateway / Instance
• Allows Instances on private
subnets to communicate
out to the internet

18. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved
DDoS
Response
Team
HTTP floods
Bad bots
Suspicious IPs
Border network
Network-layer
mitigations
AWS services
Web-layer mitigations
Customer resources
DDoS
Detect-
ion
Internet
Internet-
layer
mitigations
DDoS
SSL Attacks
Slowloris
Malformed HTTP
Large-scale attacks
SYN floods
Reflection attacks
Suspicious sources
Defense in depth
DDoS
response
team
(DRT)
Sophisticated
Layer 7 attacks

19. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved
AMI Factory
• Create secure baseline
• Monitor compliance
• Scan for vulnerabilities
• Remediate & Update
• Inspector, Config & SSM

20. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved
Vulnerability Management
Inspector
• Scan AMI as part of build
– CVE
– Configuration
• Scan / Patch Frequently
• Use with SSM to automate
patching
• Integrates with CI/CD Tools
• CVSS Scoring

21. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved
Amazon EC2 Systems Manager
• A set of capabilities that...
• ...enable automated configuration...
• ...and ongoing management of systems at scale...
• ...across all of your Windows and Linux workloads...
• ...running in Amazon EC2 or on-premises…
• ...at no charge; only pay for AWS resources you manage

22. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved
Amazon EC2 Systems Manager – Components
Run Command
State Manager
Inventory Maintenance
Window
Patch Manager Automation
Parameter Store

23. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved
Remotely and securely manage servers or virtual machines at scale
running in your data center or in AWS
 Automate common administrative tasks
 Execute commands across multiple instances simultaneously
 Support for AWS and on-premises infrastructure
 Granular permissions to control access through AWS Identity &
Access Management
 Logging using AWS CloudTrail
Run Command: Overview

24. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved
Provides secure storage for configuration data & secrets
• Store configuration data and secure strings in hierarchies and track
versions.
• Control and audit access at granular levels.
• Reference parameters across AWS services such as Amazon EC2,
Amazon EC2 Container Service, AWS Lambda, AWS
CloudFormation
Parameter Store: Overview

25. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved
Provides visibility into the software catalogue and configuration
for your Amazon EC2 instances and on-premises servers
 Gather detail on a variety of attributes, such as:
– Installed applications & OS details
– AWS components and agents
– Network configuration
 Inventory attributes are stored in AWS Config for auditing
 Assess compliance of configurations using AWS Config Rules
Inventory: Overview

26. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved
Define and maintain consistent configuration of operating systems
and applications running in your data center or in AWS
 Control configuration details such as anti-virus settings, iptables, etc.
 Define your own schedules for deployment reviews
 Compare actual deployments against specified configuration policy
 State Manager reapplies policies if state drift is detected
 Query State Manager to view status of deployments
State Manager: Overview

27. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved
Automated tool that helps you simplify your Windows operating
system patching process
 Select the patches you want to deploy
 Control timing for patch roll-outs and instance reboots
 Define auto-approval rules for patches
 Ability to black-list or white-list specific patches
 Schedule the automatic roll out through maintenance windows
Patch Manager: Overview

28. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved
Quickstart Templates
• NIST 800-53
• PCI / HIPAA
• Deploy in a few minutes
• Best practices implemented
• Great starting point
• Free
• https://aws.amazon.com/q
uickstart/

29. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved
Security Partner Solutions
https://aws.amazon.com/security/partner-solutions/

30. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved
Summary
• Ingress filtering capability: use VPC design in combination with security groups, NACLs and WAF to
establish boundaries
• Egress filtering capability: use Security Groups, NACLs, NAT gateways, route tables and VPC
endpoints
• DDoS mitigation capability use: Cloudfront (Shield) & Route 53 to mitigate layer 3 and 4 attacks
• Vulnerability & Patch management capability: use Inspector and SSM
• Use SSM for:
– Configuration and patch compliance
– Secure privileged access to instances
– Automated patch management
– Software inventory & licensing compliance
– Secrets vaulting

31. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved
Further Reading
• https://aws.amazon.com/blogs/devops/how-to-create-an-ami-builder-with-aws-codebuild-
and-hashicorp-packer/
• https://d0.awsstatic.com/aws-answers/AWS_Securing_EC2_Instances.pdf
• https://aws.amazon.com/ec2/systems-manager/

32. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved
aws.amazon.com/activate
Everything and Anything Startups
Need to Get Started on AWS