AWS Summit Milano 2019 - Sicurezza in AWS automazione e best practice - Antonio Duma, Solutions Architect, AWS | Carmela Gambardella, Solutions Architect AWS

1. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Sicurezza in AWS: automazione e
best practices
Carmela Gambardella – AWS Solutions Architect
Antonio Duma – AWS Solutions Architect

2. S U M M I T © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.

3. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
“I have come to realize that as a relatively small organization, we can be far more secure in the
cloud and achieve a higher level of assurance at a much lower cost, in terms of effort and
dollars invested. We determined that security in AWS is superior to our on-premises data
center across several dimensions, including patching, encryption, auditing and logging,
entitlements, and compliance.”
• Looks for fraud, abuse, and insider trading over
nearly 6 billion shares traded in U.S. equities
markets every day
• Processes approximately 6 terabytes of data
and 37 billion records on an average day
• Went from 3–4 weeks for server hardening
to 3–4 minutes
• DevOps teams focus on automation and tools to raise the
compliance bar and simplify controls
• Achieved incredible levels of assurance for consistencies
of builds and patching via rebooting
with automated deployment scripts
—John Brady, CISO FINRA
Financial industry regulatory authority

4. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Elevate your security with the AWS Cloud
Automate
with
comprehensive,
integrated
security services
Inherit
global
security and
compliance
controls
Highest
standards
for privacy
and data
security
Largest
network
of security
partners and
solutions
Scale with
superior visibility
and control

5. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Inherit global security and compliance controls

6. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Encryption at scaleMeet data
residency requirements
build compliant
infrastructure
Comply with local
data privacy laws
Highest standards for privacy

7. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
AWS Global Infrastructure
Region & Number
of Availability Zones
New Region (coming soon)
AWS Region
AZ
AZ
AZ AZ
Transit
Transit
Datacenter
Datacenter
Datacenter
AWS Availability Zone (AZ)

8. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
AWS Identity & Access
Management (IAM)
AWS Single Sign-On
AWS Directory Service
Amazon Cognito
AWS Organizations
AWS Secrets Manager
AWS Resource Access
Manager
AWS Security Hub
Amazon GuardDuty
AWS Config
AWS CloudTrail
Amazon
CloudWatch
VPC Flow Logs
AWS Systems Manager
AWS Shield
AWS WAF – Web
application firewall
AWS Firewall Manager
Amazon Inspector
Amazon Virtual Private
Cloud (VPC)
AWS Key Management
Service (KMS)
AWS CloudHSM
AWS Certificate Manager
Amazon Macie
Server-Side Encryption
AWS Config Rules
AWS Lambda
Identity
Detective
control
Infrastructure
security
Incident
response
Data
protection
AWS security solutions

9. S U M M I T © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.

10. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Confidentiality, Integrity, Availability of Data
Confidentiality
• Controlled, authorized access
• Preventing exposure, leakage, and theft
Integrity
• Trustworthy, coherent data
• Preventing corruption and unauthorized modification
Availability
• Reliable, timely access
• Preventing denial of service at the data layer

11. S U M M I T © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.

12. S U M M I T © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.

13. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Least Privilege Access to Data
Security best practice
Start with a minimum set of permissions
Grant additional permissions as necessary
Define only the required set of permissions
What actions a particular service supports
What collection of API actions are required for the specific task
What permissions are required to perform those actions

14. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
AWS Identity & Access Management
Identities
• Identity of actors, known as principals (users, groups, roles)
• Manage cloud identities or federate through your own identity provider
API Actions
• What does the API do or how does it respond?
Resources
• AWS resources that IAM actions apply to
• Some resource types support resource policies that further define allowed actions
Conditions:
• Precisely define required characteristics of identities, actions, resources, and other
requests parameters to allow an action

15. S U M M I T © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.

16. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
… In Transit & At Rest

17. S U M M I T © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.

18. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Clients
AWS Services
Encryption
• Customer-controlled HSMs
• Use directly or via AWS KMS
• General purpose cryptography
• Control
Easily create and control keys used to encrypt your data
• HSM-backed store for encrypting
data
• Key permissions are integrated
with IAM
• Integrated with 40+ AWS services
AWS Key
Management
Service
AWS CloudHSM

19. S U M M I T © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.

20. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
AWS Certificate Manager
• Provision certificates quickly and easily
• SSL/TLS certificates from Amazon for use with AWS resources
• Free public certificates for use on AWS
• Private certificates for your connected resources such as internal servers
and IoT devices
• Managed certificate renewal
• Secure key management
• Domain validation via DNS and email
• Import and deploy third party certificates
• Integrated with other AWS Cloud Services

21. S U M M I T © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.

22. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
AWS Secrets Manager
• Lifecycle management for secrets
• Too many humans handling secrets creates risk and
vulnerability
• Automated secret rotation provides security and
availability
• Integrated with AWS IAM and other services
• Integrates with Amazon RDS to update both clients and database server with
new credentials

23. S U M M I T © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.

24. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
AWS Well-Architected - Security Design Principles
Keep people away from data
Implement a strong identity foundation
Enable traceability
Automate security best practices
Protect data in transit and at rest
Apply security at all layers
Prepare for security events

25. S U M M I T © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.

26. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Threat Detection: Log Data Inputs
Monitor apps using
log data, store &
access log files
Amazon
CloudWatch
Logs
Track user
activity and API
usage
AWS CloudTrail
IP traffic to/from
network interfaces in
a VPC
VPC Flow Logs
Log of DNS queries
in a VPC when using
the VPC DNS
resolver
DNS Logs

27. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Threat Detection: Machine Learning
Intelligent threat detection
and continuous monitoring
to protect your AWS
accounts and workloads
Machine learning-powered
security service to discover,
classify & protect sensitive
data
Amazon GuardDuty Amazon Macie

28. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Threat Detection: Introducing AWS Security Hub
• Comprehensive view of your security state within AWS.
• Aggregates security findings and alerts generated by other AWS security services.
• Analyze security trends and identify the highest priority security issues
AWS Security Hub
Security
findings
providers
Findings
Insights
AWS Security
Partners
Amazon Inspector Amazon GuardDuty Amazon Macie

29. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Threat Detection: Evocations/Triggers
Amazon CloudWatch
Events
AWS Config Rules
Continuously tracks your resource
configuration changes and if they
violate any of the conditions in
your rules
Delivers a near real-time stream of
system events that describe
changes in AWS resources

30. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Threat Remediation: Automation
AWS Systems
Manager
Automate patching and
proactively mitigate
threats at the instance
level
AWS Lambda
Run code for virtually
any kind of application
or backend service –
zero administration

31. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Automating Responses Based on Multiple Controls
APIs
Detect
Investigate
Respond
Team
collaboration
(Slack etc.)
AWS CloudTrail
AWS Config
VPC Flow Logs
Amazon Macie
Amazon
GuardDuty
Amazon
CloudWatch
Events
Lambda
function
Amazon
Inspector

32. S U M M I T © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.

33. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
A user disables CloudTrail logging on AWS Console
A CloudWatch Event is generated and it triggers a Lambda function
The Lambda function implements a remediation action (enable logging) and
publishes a message on a SNS topic
SNS sends an email to the subscribed for notifying the events with additional
details for audit purposes
Demo: scenario #1
Amazon CloudWatch
AWS Lambda
Amazon Simple
Notification Service
AWS Identity and
Access
Management
(IAM)
AWS CloudTrail

34. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
How AWS services make it happen
Metric filter
On logs
20:59:11:27B
20:59:12:27B
20:59:13:27B
20:59:14:27B
20:59:15:27B
20:59:16:27B
20:59:17:27B
20:59:18:27B
20:59:11:27B
20:59:12:27B
20:59:13:27B
20:59:14:27B
20:59:15:27B
20:59:16:27B
20:59:17:27B
20:59:18:27B
20:59:11:27B
20:59:12:27B
20:59:13:27B
20:59:14:27B
20:59:15:27B
20:59:16:27B
20:59:17:27B
20:59:18:27B
20:59:11:27B
20:59:12:27B
20:59:13:27B
20:59:14:27B
20:59:15:27B
20:59:16:27B
20:59:17:27B
20:59:18:27B
AWS API Call via CloudTrail
Amazon CloudWatch
AWS Cloud
Event Pattern:
"eventName": [ "StopLogging" ]
"eventSource": [ "aws.cloudtrail" ]
Lambda function
Email
SNS topic
Amazon Simple
Notification
Service
AWS Management
Console
Amazon
CloudTrail
Rule
Amazon
CloudTrail

35. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
A user changes the security group of an EC2 Linux isolated instance and s/he connects
to it via ssh. The EC2 instance is monitored by CloudWatch Agent.
A CloudWatch Alarm is generated and it triggers a SNS topic. A Lambda
function is subscribed to the topic
The Lambda function implements a remediation action (force ssh logout) and
isolates the instance modifying the security group. Finally it publishes a message on
a SNS topic
SNS sends an email to the subscribed for notifying the events with additional
details for audit purposes
Demo: scenario #2
Amazon EC2
Amazon CloudWatch
AWS Lambda
Amazon Simple
Notification Service
AWS Systems Manager
AWS Identity and
Access
Management
(IAM)

36. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
with
CloudWatch
Agent
How AWS services make it happen
Metric filter
On logs
CloudWatch metrics
20:59:11:27B
20:59:12:27B
20:59:13:27B
20:59:14:27B
20:59:15:27B
20:59:16:27B
20:59:17:27B
20:59:18:27B
20:59:11:27B
20:59:12:27B
20:59:13:27B
20:59:14:27B
20:59:15:27B
20:59:16:27B
20:59:17:27B
20:59:18:27B
20:59:11:27B
20:59:12:27B
20:59:13:27B
20:59:14:27B
20:59:15:27B
20:59:16:27B
20:59:17:27B
20:59:18:27B
20:59:11:27B
20:59:12:27B
20:59:13:27B
20:59:14:27B
20:59:15:27B
20:59:16:27B
20:59:17:27B
20:59:18:27B
CloudWatch Log Groups
Amazon CloudWatch
EC2 instance
AWS Cloud
Security group
VPC
CloudWatch
Alarm
Custom
Alarm:
sshLogin Lambda function
Email
SNS topic
Amazon Simple
Notification
Service
Systems Manager
Systems
Manager

37. Thank you!
S U M M I T © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.