The document outlines AWS's shared security model, emphasizing that customers are responsible for security 'in' the cloud while AWS handles security 'of' the cloud. It details common threats such as ransomware, web application attacks, and denial-of-service, along with their consequences like data breaches and system restoration challenges. Sophos's role as a security competency partner is also highlighted, showcasing solutions that enhance security across various AWS services.

1. Shared Security in AWS
March 2017
Peter Gordon
Cloud Security Architect APAC

2. Agenda
• Shared Security Model recap
• Common threats & consequences
• Ransomware and the cloud
• Mapping controls to the SSM

3. Sophos and AWS
• Sophos is a Security Competency Partner
• Have had the UTM on the AWS Marketplace since 2011
• Solutions that integrate with several AWS services
Auto ScalingAmazon S3CloudFormationElastic Load
Balancing

4. Customer is
responsible for
security ‘in’ the
Cloud
AWS takes care
of the security
‘of’ the Cloud
AWS Shared Security Model overview

5. Common threats
• Web application attacks, such as
SQLi and XSS
• DoS and DDoS
• Ransomware
• Exploits
• Brute force attacks

6. Consequences
• Data breach
o User data / passwords
o Financial info
o Now mandatory disclosure in Australia (for some)
• Loss of data
o Encryption by ransomware
• Hijacked servers
o Used as malware delivery servers
o Participation in DDoS attacks
o Stepping stone to bigger target
• Time and cost of restoration of systems and data

7. Servers are critical assets
7
• Corporate / proprietary data on network shares
• Web site content
• Higher value targets for ransomware
• Performance and availability critical for servers

8. Ransomware and AWS – really?
• Traditionally an end point problem,
but…
o Mapped drives get hit too
o Compromised web servers may be used
to spread the malware
o Some attacks encrypt web server files
o Can be delivered through an exploit kit
o Brute force RDP attacks

9. Anatomy of a Ransomware Attack
Exploit Kit or
Spam with
Infection
Command &
Control Established
Local Files are
Encrypted
Ransomware
deleted, Ransom
Instructions
delivered

10. Why customers need more security
10
• Security Groups and NACLs
o Port or IP filtering
o No traffic or application visibility
o Unable to prevent attacks in trusted
ports
o No malware protection = no
ransomware protection
• Security vendors
o Application control
o Forward proxy with filtering
o Web Application Firewall*
o Stateful Firewall and IPS
o Anti-Malware
o Traffic visibility

11. Security Controls to address Shared Security Model
Application
Security
Data
Encryption
Access
Control
VPC / SG
/ NACL
AWS Web Services
DatabaseStorageComputeNetworking
Application
Updates
HIPS
Customer is expected
to add protection layers
WAF
VPN
NGFW
Outbound
Proxy
Host
Hardening
Customer updates OS
and Applications
Availability
ZonesRegions
Edge
Locations
AWS Global Infrastructure
OS Updates NIPS
AV/NG
Customer configures
AWS security features
Customer is
responsible for
security ‘in’ the
Cloud
AWS takes care
of the security
‘of’ the Cloud
App
Control

12. Further Mitigations
• Backup, backup, backup…
• Block communications to C&C servers
• Monitor and block encryption behaviour on servers
• Reduce attack surface - Server lockdown / application
whitelisting
• Patch your ec2 instances! OS and Applications
• DDoS mitigation services (e.g. AWS Shield)
• Other regular corporate security controls
• User education and user security controls (email etc)

13. What is Sophos doing?
• Various deployments of UTM (FW/WAF/IPS/VPN/Proxy)
o Standalone
o HA
o Auto-scaling
• Server host protection integrates with AWS
• Phishing education for users

14. 14