AWS IoT Device Defender is a fully managed service that helps you secure your fleet of IoT devices. In this session, we dive into Device Defender Detect, the feature that monitors metrics collected on device and cloud-side to identify anomalous behaviors. We get into the details of how Device Defender Detect works and metrics that it supports. The session includes a demo of how best to leverage Device Defender Detect for keeping your devices secure.

2. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Managing Security of Large IoT
Fleets
Amit Mhatre
Sr Software Dev Engineer
AWS/IoT
I O T 3 2 1
Cindy Polin
Enterprise Solutions Architect
AWS/Solutions Architecture

3. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Agenda
Security: Shared responsibility model and AWS IoT
Metrics for monitoring device behavior
Organizing security profiles across thing groups
Periodic audits to prevent security configuration drifts
Responding to AWS IoT Device Defender alerts

4. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Security: Shared responsibility model & AWS IoT Core
 Mutual TLS authentication (HTTP and MQTT)
 SigV4 authentication (HTTP and MQTT over
WebSocket)
 Policy-based authorization
 Securing credentials
 Configuring AWS IoT Core/AWS Identity and
Access Management (IAM) policies

5. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Security: Shared Responsibility Model and AWS IoT
Communication endpoints
Network traffic anomalies
Resource utilization
Number of connections
Monitor Device Behavior
Escalation of privilege
Messaging rates
Message source
Device connectivity health
Monitor Cloud Interaction
Compromised certificates
Overly permissive policies
Revoked certificates in use
Shared device identity
Monitor Security Config

6. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Metrics monitored by AWS IoT Device Defender
Source Monitoring category Metric
Device Traffic volume monitoring
• Bytes transmitted
• Bytes received
• Packets transmitted
• Packets received
Device Device access monitoring
• Listening TCP ports
• Number of listening TCP ports
• Listening UDP ports
• Number of listening UDP ports
Device Abnormal communication monitoring
• TCP destination IP addresses
• Number of established TCP connections

7. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Metrics monitored by AWS IoT Device Defender
Source Monitoring category Metric
Cloud
AWS IoT Core communication
monitoring
• Number of messages received
• Number of messages sent
• Message size
• Connection attempts
• Number of disconnects
Cloud Infiltration attempt monitoring
• Number of authorization failures
• Source IP addresses

8. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Metrics monitored by Device Defender
- 22 (ssh)
- 23 (telnet)
Device metrics
Cloud metrics

9. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Anatomy of a security profile

10. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Organizing security profiles across thing groups
ThingGroup1 ThingGroup2 ThingGroup3
All things

11. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Auditing Security Configuration
Monitor X.509 Certificates Monitor IoT Policies
Monitor Sharing of Identity Monitor Logging Configuration

12. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Responding to alerts

13. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Responding to alerts
Low Severity Topic
High Severity Topic
Send Email
Send Email
Send SMS
Invoke Lambda Mitigation Action

14. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Responding to alerts
Sample Lambda Function

15. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Key take-aways

16. Thank you!
© 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Amit Mhatre
mhatre@amazon.com
Cindy Polin
tapcindy@amazon.com

17. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.