by Brad Dispensa, Sr. Solutions Architect, AWS Operating a security practice on AWS brings many new challenges that haven't been faced in data center environments. The dynamic nature of infrastructure, the relationship between development team members and their applications, and the architecture paradigms have all changed as a result of building software on top of AWS. In this session we will cover how you can use secure configuration and automation to monitor, audit, and enforce your security policies within an AWS environment. Level 200

1. Pop-up Loft
Secure configuration and automation overview
Brad Dispensa,
Specialist SA, Security & Compliance

2. Secure development and automation
How do I do this and what tools do I use?

3. © 2018, Amazon Web Services, Inc. or Its Affiliates. All rights reserved.
Security Engineering – Then and Now

4. © 2018, Amazon Web Services, Inc. or Its Affiliates. All rights reserved.
But, do I have to?...
CostScale Reliability/
Repeatability

5. © 2018, Amazon Web Services, Inc. or Its Affiliates. All rights reserved.
AWS Security Automation Toolbox
Audit Visibility Protection Automation
AWS
CloudTrail
Amazon
CloudWatch
AWS Systems
Manager
AWS
Config
AWS
CodePipeline
AWS WAF
AWS KMSAWS Trusted
Advisor
AWS
CloudFormation
AWS
Organizations
AWS
Lambda
Amazon
Inspector

6. © 2018, Amazon Web Services, Inc. or Its Affiliates. All rights reserved.
AWS CloudTrail
Store/
Archive
Troubleshoot
Monitor & Alarm
You are
making API
calls...
On a growing
set of AWS
services around
the world..
CloudTrail is
continuously
recording
API calls

7. © 2018, Amazon Web Services, Inc. or Its Affiliates. All rights reserved.
AWS Config and Config Rules
• A continuous recording and continuous assessment service.
Changing resources
AWS Config
Config Rules
History, Snapshot
Notifications
API Access
Normalized
Answer the questions:
How are my resources configured over time?
Is a change, that just occurred to a resource, compliant?

8. © 2018, Amazon Web Services, Inc. or Its Affiliates. All rights reserved.
Amazon CloudWatch Events
AWS APIs
Custom Events
Service Events
AWS APIs
event
(time-based)
event
(event-based)
Custom
Rules
Targets

9. © 2018, Amazon Web Services, Inc. or Its Affiliates. All rights reserved.
AWS Systems Manager Components
Run Command State Manager Inventory Maintenance Window
Patch Manager Automation Parameter Store Documents

10. © 2018, Amazon Web Services, Inc. or Its Affiliates. All rights reserved.
Template CloudFormation Stack
JSON formatted file
Parameter definition
Resource creation
Configuration actions
Configured AWS resources
Comprehensive service support
Service event aware
Customizable
Framework
Stack creation
Stack updates
Error detection and rollback
CloudFormation – Components & Technology

11. © 2018, Amazon Web Services, Inc. or Its Affiliates. All rights reserved.
Security at Every Stage
DevOps = Efficiencies that speed up this lifecycle
DevSecOps = Validate building blocks without slowing lifecycle
Developers Customers
releasetestbuild
plan monitor
Delivery pipeline
Feedback loop
Security

12. © 2018, Amazon Web Services, Inc. or Its Affiliates. All rights reserved.
DevSecOps Pipeline #1
AWS
Lambda
(or AWS
CodeBuild)
AWS
CodeCommit
(or S3/GitHub)
AWS
CodePipeline
AWS
CodePipeline
Developer commits
CloudFormation
Policy FAIL
PASS
Developers
Stack

13. © 2018, Amazon Web Services, Inc. or Its Affiliates. All rights reserved.
https://aws.amazon.com/blogs/devops/implementing-devsecops-using-aws-codepipeline/
CodePipeline
Commit Stage Test Stage Production Stage
Static Code Analysis Lambda Stack Validation
Lambda
Create
Stack
Delete
Stack
Approve
Stack
Create
ChangeSet
Execute
ChangeSet
DevOps S3
Push/Pull
DevSecOps Pipeline #2

14. © 2018, Amazon Web Services, Inc. or Its Affiliates. All rights reserved.
https://aws.amazon.com/answers/devops/aws-cloudformation-validation-pipeline/
DevSecOps Pipeline #3
CodePipelineDevOps
Push/Pull
CodeCommit
Pre-create
Pre-create Lambda
CodeBuild / cfn-nag
Stack creation
Create stacks
CloudFormation
Post-create
Post-create Lambda
SNS notification
Deploy
Deploy Lambda
S3 bucket
Manual Approval

15. © 2018, Amazon Web Services, Inc. or Its Affiliates. All rights reserved.
Security Automation Output Patterns
Amazon
CloudWatch
AWS
CloudTrail
VPC Flow logs
AWS Config
Lambda
function
AWS APIs
AWS WAF
Team collaboration
(Slack etc.)
Detection
Alerting
Remediation
Countermeasures
Forensics

16. Post deployment configuration
We’re in prod… now what?

17. GuardDuty Threat Detection and Notification

18. GuardDuty Account Relationships
• Adding accounts to the services is simple and done via the console or API.
• Invites accepted from an account will be designated as “Member” accounts. The
requestor will be the “Master” account.
Member
Account
……. .
1
Member
Account
1000 (max)
Master Account
Can Do the Following to ALL accounts:
• Generate Sample Findings
• Configure and View/Manage Findings
• Suspend GuardDuty Service
• Upload and Manage Trusted IP and
Threat IP Lists (coming soon!)
Can only disable own account. Member
accounts must all be removed first and by the
member account.
Member Account Actions and
Visibility is Limited to the
Member Account.
Each Account Billed Separately.

19. GuardDuty Findings: Console / API
AWS Management Console API / JSON Format
Quickly See Threat
Information Including:
• Severity
• Region
• Count/Frequency
• Threat Type
• Affected Resource
• Source Information
• Viewable via
CloudWatch Events
Export Finding Data for
Further Analysis Including:
• Ingest into SIEM
• Data Enrichment
• Programmatic
Response
• Additional Information
• ARN
• Span of Time
• Resource Info

20. ThreatPurpose ThreatFamilyName ThreatFamilyVariant: ResourceTypeAffected / . ! Artifact
Meaning: “An EC2 instance is communicating with a known Bitcoin IP
address that is part of a known Bitcoin domain”
CryptoCurrency BitcoinTool B: EC2 / . ! DNS
GuardDuty Finding: Details

21. GuardDuty Findings: Threat Purpose Details
• Backdoor: resource compromised and capable of contacting source home
• Behavior: activity that differs from established baseline
• Crypto Currency: detected software associated with Crypto currencies
• Pentest: activity detected similar to that generated by known pen testing tools
• Recon: attack scoping vulnerabilities by probing ports, listening, database tables, etc.
• Stealth: attack trying to hide actions / tracks
• Trojan: program detected carrying out suspicious activity
• Unauthorized Access: suspicious activity / pattern by unauthorized user
Describes the primary purpose of the threat. Available at launch, more coming!

22. GuardDuty Findings: CloudWatch Events (CWE)
• GuardDuty aggregates all
changes to findings that take
place in five-minute intervals
into a single event.
• CloudWatch Events can be
graphed, stored, exported,
and further analyzed. Example GuardDuty Related CloudWatch Event

23. GuardDuty Findings: Severity Levels
LOW MEDIUM HIGH
Suspicious or malicious
activity blocked before it
compromised a resource.
Suspicious activity deviating
from normally observed
behavior.
Resource compromised and
actively being used for
unauthorized purpose.
Suggestion:
Take Immediate Action(s)
• Terminate instance(s)
• Rotate IAM access keys
Suggestion:
Investigate Further
• Check new software that
changed the behavior of a
resource
• Check changes to settings
• AV scan on resource (detect
unauthorized software)
• Examine permissions attached
to IAM entity implicated
Suggestion:
Take Immediate Action(s)
• No immediate recommended
steps – but take note of info
as something to address in
the future

24. “I need to make a change, I’ll SSH in and…”
Things you don’t need to hear any more

25. © 2018, Amazon Web Services, Inc. or Its Affiliates. All rights reserved.
• Remotely manage thousands of
Windows and Linux instances running on
Amazon EC2 or on-premises
• Control user actions and scope with
secure, granular access control
• Safely execute changes with rate control
to reduce blast radius
• Audit every user action with change
tracking
Safe and secure ops at scale without SSH/RDP
AWS cloud
corporate data
center
IT Admin, DevOps
Engineer
Role-based
Access Control

26. © 2018, Amazon Web Services, Inc. or Its Affiliates. All rights reserved.
Store and retrieve configuration secrets
• Store any configuration data or
parameter in hierarchies with RBAC
• Option to encrypt secret data like
passwords using KMS
• Enforce password policies using
parameter lifetime and change
notifications
• Use across AWS services such as
Lambda, AWS CodeDeploy, and ECS
parameter
store
instances
secrets
Change
Notification
No more storing secrets in plain text!

27. Move choice away from humans
Automation of security binaries

28. event
(event-based)
Amazon
CloudWatch
AWS re:Invent 2016: Automating Security Event Response, from Idea to Code to Execution
(SEC313) https://youtu.be/x4GkAGe65vE
Adversary Responder

29. Adversary
cloudtrail:StopLogging
CloudTrail

30. CloudWatch
Events event
Adversary
{
"detail-type": [ "AWS API Call via CloudTrail" ],
"detail": {
"eventSource": [ "cloudtrail.amazonaws.com" ],
"eventName": [ "StopLogging" ]
}
}

31. Adversary Responder
cloudtrail.start_logging

32. Permission review
The role has temporary admin privileges, but we’ll fix that later…

33. Analyze Security, Compliance, and Operational Activity Using
AWS CloudTrail and Amazon Athena
Sai Sriparasa and Bob O'Dell

34. Access advisor is cool, but today it’s GUI access only..

35. select
useridentity.sessioncontext.sessionIssuer.userNa
me as uid, eventsource, eventname
from cloudtrail_logs
Where
useridentity.sessioncontext.sessionIssuer.userNa
me = ‘target-name’
GROUP BY
useridentity.sessioncontext.sessionIssuer.userNa
me, eventsource, eventname
Query cloud trail data for the target user or role with
Athena

36. https://github.com/Netflix-
Skunkworks/aardvark
https://github.com/Netflix/Repokid

37. Pop-up Loft
aws.amazon.com/activate
Everything and Anything Startups
Need to Get Started on AWS