Slides from my Dev Chat at the Atlanta AWS Summit. or How 4th Grade Math, Spreadsheets and a lot of Lambda improved my employer's cloud security posture.

1. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Chris Farris
Cloud Security Architect - Turner Broadcasting
DEV09
Moving the Needle
On Cloud Security

2. Who am I?
● Cloud Security Architect for Turner Broadcasting
● My job is to keep the Russians off cnn.com and my
friends from downloading Rick & Morty

3. Our migration strategy

4. State of Cloud Security

5. The Problem
● 200 AWS Accounts
● 80 Development Teams
● Varying levels of cloud experience
● Myth of The Great Firewall Charlie Brown
● InfoSec team will get the blame
● This: 14 million customer records leaked
4 million credit cards stolen
Millions of classified images stolen

6. Accountability & Account-Ability
● Every AWS Account has a VP accountable to Security
and Finance for all activities
● Every team gets a prod and non-prod account
● This is how you get to
200+ accounts!
● Automation is key

7. Accountability
Did ya get that
open Security
Group I sent
you?

8. tl;dr
● API Calls against AWS
● Fourth Grade Math
○ 1 - (non-compliant / total-resources)
● Primary Colors in boxes
● Excel

9. Spreadsheets

10. AWS gives you the tools
● AWS Lambda
● AWS Step functions
● AWS IAM Cross Account Roles
● AWS DynamoDB
● S3
● SNS
● SES

11. You’ve got to put it all together

12. Prerequisites:
● Security AWS Account
● Cross-Account Audit Roles
● AWS Organizations
● Cloud Security Standard

13. Cloud Security Standard
- KISS
- Focus on your risk and your culture
- CIS Benchmarks are valuable
- Consensus Driven
- Requirements “must”
- Best Practices “should”

14. Build your AWS Inventory
1. Get all accounts
2. Fire off lambda for
each account
3. Build Reports
4. Profit!

15. List Accounts

16. What do I gather?
● ec2.describe_instances()
● ec2.describe_security_groups()
● ec2.describe_network_interfaces()
● health.describe_events()
● cloudwatch.get_metric_statistics()
● Req. CloudFormation Templates
● CloudSploit

17. Run your compliance checks
1. Gather Data
2. Build list of non-
compliant resources
3. Apply Exceptions
4. Calculate Scores
5. Spreadsheets!

18. Start
Import Exceptions Import Attestation
SNS Trigger
Apply Exceptions
SNS Trigger
Gather Data
Populate Non-
compliant
Resource Lists
Calculate
Requirement
Scores
SNS Trigger
Create
Individualized
Scorecards

19. Spray & Pray

20. Spray & Pray

21. Cloud Security Standard

23. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Questions?
• @jcfarris
• https://github.com/jchrisfarris
• https://www.linkedin.com/in/jcfarris
• http://www.chrisfarris.com