SlideShare a Scribd company logo
© 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
The Zen of governance:
Establish guardrails and empower builders
Sam Hennessy
Solutions architect
Amazon Web Services
S V C 2 0 1
© 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Once upon a time …
© 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
The story
W
al
l
Product owners IT operationsDevelopers
W
al
l
W
al
l
W
al
l
QA Security
1
2
1
3
4
5
6
6
© 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Competing priorities
Lack of understanding
Wildly different environments
No singular tool chain
Slow
Repetitive workflows
Lack of security influence
Everyone is frustrated (usually with each other)
Does this work?
© 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Just do DevOps
© 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Who is responsible for what
Responsible for
Their
product
Deployment tools
CI/CD tools
Monitoring tools
Metrics tool
Logging tools
APM tools
Infrastructure provisioning
tools
Security tools
Database management tools
Testing tools
….
Not responsible for
© 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Who does QA?
• The team
Who is responsible to deliver a secure product?
• The team
Who is responsible to operate and maintain the product?
• The team
Who is responsible for production failures and issues (on call)?
• The team
Who is responsible for monitoring, logging, and application analysis?
• The team
Do you see a pattern?
Who is responsible for what
© 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
This will solve all my problems?
Not quite …
© 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
The challenges
Training
Tools
Processes
Bottlenecks
© 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Training
Quality
Security
Operations
© 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
The bottlenecks
Security and compliance validation
Software release
Infrastructure provisioning
Account provisioning
© 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Self service is the key to scalability
© 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
You want to let whom do what?
© 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Guardrails to the rescue
Secure SDLC (sSDLC)
Separation of duties
Logging
© 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Guardrails enablement tools
© 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
sSDLC: Software guardrails
Code review
Authorization controls
Security testing
Separation of duties
Security monitoring
Audit trail
Security training
© 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Separation of duties: Isolation guardrails
Account throttling and limits
Minimal permission
Reduce blast effect
Framework compliance
© 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Separation of duties: Tools and processes
Tools should be managed like internal services
Teams should manage the access and availability of the tools, not their use
Ask why self-service cannot be used, instead of why it should be used
© 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Separation of duties: Production
AWS Cloud
Shared services
CI/CD tools
QA
Staging
Production
Logging and change control
© 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Logging: Tracking guardrails
Change control
Centralized collection
Don’t just let logs sit there
© 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Guardrails at scale
© 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Multi-account
Centralized management
Access administration
Easy auditing
Security assets
AWS Cloud
Organizations
Master
Shared services
Security and logging
© 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Multi-account: Provisioning
Organizations
Homegrown
AWS Landing Zones
AWS Control Tower
Amazon CloudWatchIAMAWS CloudTrail
AWS Systems
Manager documents
© 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Multi-account: Continuous compliance
AWS Config
AWS Systems Manager
AWS CloudFormation drift detection
AWS CloudTrail
© 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Multi-account: Example
AWS Cloud
AWS Organizations
Master Security
Shared
SCPs
AWS Landing Zone
AWS Control Tower
Homegrown
Application accounts
AWS Service Catalog
AWS Config
AWS Systems Manager
Shared production tools
AWS CloudTrail
© 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Resource provisioning
Should be part of CI/CD process
AWS CloudFormation
AWS Service Catalog
AWS OpsWorks
© 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Resource provisioning: Processes
ReleaseBuildSource
Testing
Security
peer review
static code analysis
linters
style guides
Testing
Security
unit testing
• functional
• security
Testing
Security
integration testing
performanace testing
UAT
pen/vuln testing
smoke testing
AWS CodePipeline
AWS CodeBuild
AWS CodeCommit
AWS CodeDeploy
© 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Recap
DevOps is a good starting point
Self-service is the key to enablement
Multi-account tooling
Centralized governance; tighten controls to loosen innovation
Thank you!
S U M M I T © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Sam Hennessy

More Related Content

What's hot

Developing your Cloud Center of Excellence using CloudHealth - DEM03 - Atlant...
Developing your Cloud Center of Excellence using CloudHealth - DEM03 - Atlant...Developing your Cloud Center of Excellence using CloudHealth - DEM03 - Atlant...
Developing your Cloud Center of Excellence using CloudHealth - DEM03 - Atlant...
Amazon Web Services
 
Optimizing your workloads with Amazon EC2 and AMD EPYC processors - DEM01-SR ...
Optimizing your workloads with Amazon EC2 and AMD EPYC processors - DEM01-SR ...Optimizing your workloads with Amazon EC2 and AMD EPYC processors - DEM01-SR ...
Optimizing your workloads with Amazon EC2 and AMD EPYC processors - DEM01-SR ...
Amazon Web Services
 
Deep dive on AWS Cloud storage offerings - What to use, where, and why - STG3...
Deep dive on AWS Cloud storage offerings - What to use, where, and why - STG3...Deep dive on AWS Cloud storage offerings - What to use, where, and why - STG3...
Deep dive on AWS Cloud storage offerings - What to use, where, and why - STG3...
Amazon Web Services
 
Improve contact center and CRM experiences via machine learning and analytics...
Improve contact center and CRM experiences via machine learning and analytics...Improve contact center and CRM experiences via machine learning and analytics...
Improve contact center and CRM experiences via machine learning and analytics...
Amazon Web Services
 
Industry 4.0 in the cloud - SVC214 - Chicago AWS Summit
Industry 4.0 in the cloud - SVC214 - Chicago AWS SummitIndustry 4.0 in the cloud - SVC214 - Chicago AWS Summit
Industry 4.0 in the cloud - SVC214 - Chicago AWS Summit
Amazon Web Services
 
Introduction to the Well-Architected Framework and Tool - SVC212 - Chicago AW...
Introduction to the Well-Architected Framework and Tool - SVC212 - Chicago AW...Introduction to the Well-Architected Framework and Tool - SVC212 - Chicago AW...
Introduction to the Well-Architected Framework and Tool - SVC212 - Chicago AW...
Amazon Web Services
 
Move desktops & applications to AWS with Amazon WorkSpaces & AppStream 2.0 - ...
Move desktops & applications to AWS with Amazon WorkSpaces & AppStream 2.0 - ...Move desktops & applications to AWS with Amazon WorkSpaces & AppStream 2.0 - ...
Move desktops & applications to AWS with Amazon WorkSpaces & AppStream 2.0 - ...
Amazon Web Services
 
What's new in Amazon Aurora - ADB204 - Santa Clara AWS Summit.pdf
What's new in Amazon Aurora - ADB204 - Santa Clara AWS Summit.pdfWhat's new in Amazon Aurora - ADB204 - Santa Clara AWS Summit.pdf
What's new in Amazon Aurora - ADB204 - Santa Clara AWS Summit.pdf
Amazon Web Services
 
Get hands-on with AWS DeepRacer and compete in the AWS DeepRacer League - AIM...
Get hands-on with AWS DeepRacer and compete in the AWS DeepRacer League - AIM...Get hands-on with AWS DeepRacer and compete in the AWS DeepRacer League - AIM...
Get hands-on with AWS DeepRacer and compete in the AWS DeepRacer League - AIM...
Amazon Web Services
 
Train once, deploy anywhere on the cloud and at the edge with Neo - AIM301 - ...
Train once, deploy anywhere on the cloud and at the edge with Neo - AIM301 - ...Train once, deploy anywhere on the cloud and at the edge with Neo - AIM301 - ...
Train once, deploy anywhere on the cloud and at the edge with Neo - AIM301 - ...
Amazon Web Services
 
A Culture of Rapid Innovation with DevOps, Microservices, & Serverless - MAD2...
A Culture of Rapid Innovation with DevOps, Microservices, & Serverless - MAD2...A Culture of Rapid Innovation with DevOps, Microservices, & Serverless - MAD2...
A Culture of Rapid Innovation with DevOps, Microservices, & Serverless - MAD2...
Amazon Web Services
 
Modernizing your data warehouse using Amazon Redshift - ADB303 - Chicago AWS ...
Modernizing your data warehouse using Amazon Redshift - ADB303 - Chicago AWS ...Modernizing your data warehouse using Amazon Redshift - ADB303 - Chicago AWS ...
Modernizing your data warehouse using Amazon Redshift - ADB303 - Chicago AWS ...
Amazon Web Services
 
AWS IoT services - Extract value for industrial applications - SVC205 - Santa...
AWS IoT services - Extract value for industrial applications - SVC205 - Santa...AWS IoT services - Extract value for industrial applications - SVC205 - Santa...
AWS IoT services - Extract value for industrial applications - SVC205 - Santa...
Amazon Web Services
 
Architecting SAP on Amazon Web Services - SVC216 - Chicago AWS Summit
Architecting SAP on Amazon Web Services - SVC216 - Chicago AWS SummitArchitecting SAP on Amazon Web Services - SVC216 - Chicago AWS Summit
Architecting SAP on Amazon Web Services - SVC216 - Chicago AWS Summit
Amazon Web Services
 
What's new in Amazon Aurora - ADB203 - Atlanta AWS Summit
What's new in Amazon Aurora - ADB203 - Atlanta AWS SummitWhat's new in Amazon Aurora - ADB203 - Atlanta AWS Summit
What's new in Amazon Aurora - ADB203 - Atlanta AWS Summit
Amazon Web Services
 
Detecting and responding to critical events with AWS IoT Events - SVC205 - Ch...
Detecting and responding to critical events with AWS IoT Events - SVC205 - Ch...Detecting and responding to critical events with AWS IoT Events - SVC205 - Ch...
Detecting and responding to critical events with AWS IoT Events - SVC205 - Ch...
Amazon Web Services
 
Developing Your Cloud Center of Excellence Using CloudHealth - DEM04-S - Anah...
Developing Your Cloud Center of Excellence Using CloudHealth - DEM04-S - Anah...Developing Your Cloud Center of Excellence Using CloudHealth - DEM04-S - Anah...
Developing Your Cloud Center of Excellence Using CloudHealth - DEM04-S - Anah...
Amazon Web Services
 
Developing your Cloud Center of Excellence using CloudHealth - DEM04-S - New ...
Developing your Cloud Center of Excellence using CloudHealth - DEM04-S - New ...Developing your Cloud Center of Excellence using CloudHealth - DEM04-S - New ...
Developing your Cloud Center of Excellence using CloudHealth - DEM04-S - New ...
Amazon Web Services
 
Increasing the value of video with machine learning & AWS Media Services - SV...
Increasing the value of video with machine learning & AWS Media Services - SV...Increasing the value of video with machine learning & AWS Media Services - SV...
Increasing the value of video with machine learning & AWS Media Services - SV...
Amazon Web Services
 
Connecting low-power devices to the cloud with Amazon FreeRTOS BLE - SVC206 -...
Connecting low-power devices to the cloud with Amazon FreeRTOS BLE - SVC206 -...Connecting low-power devices to the cloud with Amazon FreeRTOS BLE - SVC206 -...
Connecting low-power devices to the cloud with Amazon FreeRTOS BLE - SVC206 -...
Amazon Web Services
 

What's hot (20)

Developing your Cloud Center of Excellence using CloudHealth - DEM03 - Atlant...
Developing your Cloud Center of Excellence using CloudHealth - DEM03 - Atlant...Developing your Cloud Center of Excellence using CloudHealth - DEM03 - Atlant...
Developing your Cloud Center of Excellence using CloudHealth - DEM03 - Atlant...
 
Optimizing your workloads with Amazon EC2 and AMD EPYC processors - DEM01-SR ...
Optimizing your workloads with Amazon EC2 and AMD EPYC processors - DEM01-SR ...Optimizing your workloads with Amazon EC2 and AMD EPYC processors - DEM01-SR ...
Optimizing your workloads with Amazon EC2 and AMD EPYC processors - DEM01-SR ...
 
Deep dive on AWS Cloud storage offerings - What to use, where, and why - STG3...
Deep dive on AWS Cloud storage offerings - What to use, where, and why - STG3...Deep dive on AWS Cloud storage offerings - What to use, where, and why - STG3...
Deep dive on AWS Cloud storage offerings - What to use, where, and why - STG3...
 
Improve contact center and CRM experiences via machine learning and analytics...
Improve contact center and CRM experiences via machine learning and analytics...Improve contact center and CRM experiences via machine learning and analytics...
Improve contact center and CRM experiences via machine learning and analytics...
 
Industry 4.0 in the cloud - SVC214 - Chicago AWS Summit
Industry 4.0 in the cloud - SVC214 - Chicago AWS SummitIndustry 4.0 in the cloud - SVC214 - Chicago AWS Summit
Industry 4.0 in the cloud - SVC214 - Chicago AWS Summit
 
Introduction to the Well-Architected Framework and Tool - SVC212 - Chicago AW...
Introduction to the Well-Architected Framework and Tool - SVC212 - Chicago AW...Introduction to the Well-Architected Framework and Tool - SVC212 - Chicago AW...
Introduction to the Well-Architected Framework and Tool - SVC212 - Chicago AW...
 
Move desktops & applications to AWS with Amazon WorkSpaces & AppStream 2.0 - ...
Move desktops & applications to AWS with Amazon WorkSpaces & AppStream 2.0 - ...Move desktops & applications to AWS with Amazon WorkSpaces & AppStream 2.0 - ...
Move desktops & applications to AWS with Amazon WorkSpaces & AppStream 2.0 - ...
 
What's new in Amazon Aurora - ADB204 - Santa Clara AWS Summit.pdf
What's new in Amazon Aurora - ADB204 - Santa Clara AWS Summit.pdfWhat's new in Amazon Aurora - ADB204 - Santa Clara AWS Summit.pdf
What's new in Amazon Aurora - ADB204 - Santa Clara AWS Summit.pdf
 
Get hands-on with AWS DeepRacer and compete in the AWS DeepRacer League - AIM...
Get hands-on with AWS DeepRacer and compete in the AWS DeepRacer League - AIM...Get hands-on with AWS DeepRacer and compete in the AWS DeepRacer League - AIM...
Get hands-on with AWS DeepRacer and compete in the AWS DeepRacer League - AIM...
 
Train once, deploy anywhere on the cloud and at the edge with Neo - AIM301 - ...
Train once, deploy anywhere on the cloud and at the edge with Neo - AIM301 - ...Train once, deploy anywhere on the cloud and at the edge with Neo - AIM301 - ...
Train once, deploy anywhere on the cloud and at the edge with Neo - AIM301 - ...
 
A Culture of Rapid Innovation with DevOps, Microservices, & Serverless - MAD2...
A Culture of Rapid Innovation with DevOps, Microservices, & Serverless - MAD2...A Culture of Rapid Innovation with DevOps, Microservices, & Serverless - MAD2...
A Culture of Rapid Innovation with DevOps, Microservices, & Serverless - MAD2...
 
Modernizing your data warehouse using Amazon Redshift - ADB303 - Chicago AWS ...
Modernizing your data warehouse using Amazon Redshift - ADB303 - Chicago AWS ...Modernizing your data warehouse using Amazon Redshift - ADB303 - Chicago AWS ...
Modernizing your data warehouse using Amazon Redshift - ADB303 - Chicago AWS ...
 
AWS IoT services - Extract value for industrial applications - SVC205 - Santa...
AWS IoT services - Extract value for industrial applications - SVC205 - Santa...AWS IoT services - Extract value for industrial applications - SVC205 - Santa...
AWS IoT services - Extract value for industrial applications - SVC205 - Santa...
 
Architecting SAP on Amazon Web Services - SVC216 - Chicago AWS Summit
Architecting SAP on Amazon Web Services - SVC216 - Chicago AWS SummitArchitecting SAP on Amazon Web Services - SVC216 - Chicago AWS Summit
Architecting SAP on Amazon Web Services - SVC216 - Chicago AWS Summit
 
What's new in Amazon Aurora - ADB203 - Atlanta AWS Summit
What's new in Amazon Aurora - ADB203 - Atlanta AWS SummitWhat's new in Amazon Aurora - ADB203 - Atlanta AWS Summit
What's new in Amazon Aurora - ADB203 - Atlanta AWS Summit
 
Detecting and responding to critical events with AWS IoT Events - SVC205 - Ch...
Detecting and responding to critical events with AWS IoT Events - SVC205 - Ch...Detecting and responding to critical events with AWS IoT Events - SVC205 - Ch...
Detecting and responding to critical events with AWS IoT Events - SVC205 - Ch...
 
Developing Your Cloud Center of Excellence Using CloudHealth - DEM04-S - Anah...
Developing Your Cloud Center of Excellence Using CloudHealth - DEM04-S - Anah...Developing Your Cloud Center of Excellence Using CloudHealth - DEM04-S - Anah...
Developing Your Cloud Center of Excellence Using CloudHealth - DEM04-S - Anah...
 
Developing your Cloud Center of Excellence using CloudHealth - DEM04-S - New ...
Developing your Cloud Center of Excellence using CloudHealth - DEM04-S - New ...Developing your Cloud Center of Excellence using CloudHealth - DEM04-S - New ...
Developing your Cloud Center of Excellence using CloudHealth - DEM04-S - New ...
 
Increasing the value of video with machine learning & AWS Media Services - SV...
Increasing the value of video with machine learning & AWS Media Services - SV...Increasing the value of video with machine learning & AWS Media Services - SV...
Increasing the value of video with machine learning & AWS Media Services - SV...
 
Connecting low-power devices to the cloud with Amazon FreeRTOS BLE - SVC206 -...
Connecting low-power devices to the cloud with Amazon FreeRTOS BLE - SVC206 -...Connecting low-power devices to the cloud with Amazon FreeRTOS BLE - SVC206 -...
Connecting low-power devices to the cloud with Amazon FreeRTOS BLE - SVC206 -...
 

Similar to Threat detection and mitigation at AWS - SEC201 - Atlanta AWS Summit

Introduction to AWS Global Accelerator - SVC212 - New York AWS Summit
Introduction to AWS Global Accelerator - SVC212 - New York AWS SummitIntroduction to AWS Global Accelerator - SVC212 - New York AWS Summit
Introduction to AWS Global Accelerator - SVC212 - New York AWS Summit
Amazon Web Services
 
Introduction to the Well-Architected Framework and Tool - SVC208 - Anaheim AW...
Introduction to the Well-Architected Framework and Tool - SVC208 - Anaheim AW...Introduction to the Well-Architected Framework and Tool - SVC208 - Anaheim AW...
Introduction to the Well-Architected Framework and Tool - SVC208 - Anaheim AW...
Amazon Web Services
 
Take action on your security & compliance alerts with AWS Security Hub - SEC2...
Take action on your security & compliance alerts with AWS Security Hub - SEC2...Take action on your security & compliance alerts with AWS Security Hub - SEC2...
Take action on your security & compliance alerts with AWS Security Hub - SEC2...
Amazon Web Services
 
Architecting security & governance across your AWS environment
Architecting security & governance across your AWS environmentArchitecting security & governance across your AWS environment
Architecting security & governance across your AWS environment
Amazon Web Services
 
Security framework shakedown_-_chart_your_journey_with_aws_best_practices_ini...
Security framework shakedown_-_chart_your_journey_with_aws_best_practices_ini...Security framework shakedown_-_chart_your_journey_with_aws_best_practices_ini...
Security framework shakedown_-_chart_your_journey_with_aws_best_practices_ini...
Amazon Web Services LATAM
 
Security Framework Shakedown- Mapeie sua jornada com as melhores práticas da AWS
Security Framework Shakedown- Mapeie sua jornada com as melhores práticas da AWSSecurity Framework Shakedown- Mapeie sua jornada com as melhores práticas da AWS
Security Framework Shakedown- Mapeie sua jornada com as melhores práticas da AWS
Amazon Web Services LATAM
 
DevOps at Amazon
DevOps at AmazonDevOps at Amazon
DevOps at Amazon
Amazon Web Services
 
Software delivery best practices: Lessons from Amazon and our customers - MAD...
Software delivery best practices: Lessons from Amazon and our customers - MAD...Software delivery best practices: Lessons from Amazon and our customers - MAD...
Software delivery best practices: Lessons from Amazon and our customers - MAD...
Amazon Web Services
 
How Millennium Management achieves provable security with AWS Zelkova - FSV30...
How Millennium Management achieves provable security with AWS Zelkova - FSV30...How Millennium Management achieves provable security with AWS Zelkova - FSV30...
How Millennium Management achieves provable security with AWS Zelkova - FSV30...
Amazon Web Services
 
Safeguard the Integrity of Your Code for Fast and Secure Deployments - SVC206...
Safeguard the Integrity of Your Code for Fast and Secure Deployments - SVC206...Safeguard the Integrity of Your Code for Fast and Secure Deployments - SVC206...
Safeguard the Integrity of Your Code for Fast and Secure Deployments - SVC206...
Amazon Web Services
 
Cloud Operating Models for Accelerated Cloud Transformation - AWS Summit Sydney
Cloud Operating Models for Accelerated Cloud Transformation - AWS Summit SydneyCloud Operating Models for Accelerated Cloud Transformation - AWS Summit Sydney
Cloud Operating Models for Accelerated Cloud Transformation - AWS Summit Sydney
Amazon Web Services
 
Safeguarding the integrity of your code for fast, secure deployments - SVC301...
Safeguarding the integrity of your code for fast, secure deployments - SVC301...Safeguarding the integrity of your code for fast, secure deployments - SVC301...
Safeguarding the integrity of your code for fast, secure deployments - SVC301...
Amazon Web Services
 
How Nubank is building a customer-obsessed bank - FSV201 - New York AWS Summit
How Nubank is building a customer-obsessed bank - FSV201 - New York AWS SummitHow Nubank is building a customer-obsessed bank - FSV201 - New York AWS Summit
How Nubank is building a customer-obsessed bank - FSV201 - New York AWS Summit
Amazon Web Services
 
Finding all the threats: AWS threat detection and remediation - SEC303 - Chic...
Finding all the threats: AWS threat detection and remediation - SEC303 - Chic...Finding all the threats: AWS threat detection and remediation - SEC303 - Chic...
Finding all the threats: AWS threat detection and remediation - SEC303 - Chic...
Amazon Web Services
 
Tools for building your MVP on AWS
Tools for building your MVP on AWSTools for building your MVP on AWS
Tools for building your MVP on AWS
Cobus Bernard
 
Introduction to the Well-Architected Framework and Tool - SVC212 - Santa Clar...
Introduction to the Well-Architected Framework and Tool - SVC212 - Santa Clar...Introduction to the Well-Architected Framework and Tool - SVC212 - Santa Clar...
Introduction to the Well-Architected Framework and Tool - SVC212 - Santa Clar...
Amazon Web Services
 
Are you Well Architected?
Are you Well Architected?Are you Well Architected?
Are you Well Architected?
Amazon Web Services
 
AWS Summit Singapore 2019 | AWS Techfest Opening Keynote
AWS Summit Singapore 2019 | AWS Techfest Opening KeynoteAWS Summit Singapore 2019 | AWS Techfest Opening Keynote
AWS Summit Singapore 2019 | AWS Techfest Opening Keynote
AWS Summits
 
Secure Your Data with Recommended Best Practices Enabled by AWS Security and ...
Secure Your Data with Recommended Best Practices Enabled by AWS Security and ...Secure Your Data with Recommended Best Practices Enabled by AWS Security and ...
Secure Your Data with Recommended Best Practices Enabled by AWS Security and ...
Amazon Web Services
 
Security at Scale: Security Hub and the Well Architected Framework - AWS Summ...
Security at Scale: Security Hub and the Well Architected Framework - AWS Summ...Security at Scale: Security Hub and the Well Architected Framework - AWS Summ...
Security at Scale: Security Hub and the Well Architected Framework - AWS Summ...
Amazon Web Services
 

Similar to Threat detection and mitigation at AWS - SEC201 - Atlanta AWS Summit (20)

Introduction to AWS Global Accelerator - SVC212 - New York AWS Summit
Introduction to AWS Global Accelerator - SVC212 - New York AWS SummitIntroduction to AWS Global Accelerator - SVC212 - New York AWS Summit
Introduction to AWS Global Accelerator - SVC212 - New York AWS Summit
 
Introduction to the Well-Architected Framework and Tool - SVC208 - Anaheim AW...
Introduction to the Well-Architected Framework and Tool - SVC208 - Anaheim AW...Introduction to the Well-Architected Framework and Tool - SVC208 - Anaheim AW...
Introduction to the Well-Architected Framework and Tool - SVC208 - Anaheim AW...
 
Take action on your security & compliance alerts with AWS Security Hub - SEC2...
Take action on your security & compliance alerts with AWS Security Hub - SEC2...Take action on your security & compliance alerts with AWS Security Hub - SEC2...
Take action on your security & compliance alerts with AWS Security Hub - SEC2...
 
Architecting security & governance across your AWS environment
Architecting security & governance across your AWS environmentArchitecting security & governance across your AWS environment
Architecting security & governance across your AWS environment
 
Security framework shakedown_-_chart_your_journey_with_aws_best_practices_ini...
Security framework shakedown_-_chart_your_journey_with_aws_best_practices_ini...Security framework shakedown_-_chart_your_journey_with_aws_best_practices_ini...
Security framework shakedown_-_chart_your_journey_with_aws_best_practices_ini...
 
Security Framework Shakedown- Mapeie sua jornada com as melhores práticas da AWS
Security Framework Shakedown- Mapeie sua jornada com as melhores práticas da AWSSecurity Framework Shakedown- Mapeie sua jornada com as melhores práticas da AWS
Security Framework Shakedown- Mapeie sua jornada com as melhores práticas da AWS
 
DevOps at Amazon
DevOps at AmazonDevOps at Amazon
DevOps at Amazon
 
Software delivery best practices: Lessons from Amazon and our customers - MAD...
Software delivery best practices: Lessons from Amazon and our customers - MAD...Software delivery best practices: Lessons from Amazon and our customers - MAD...
Software delivery best practices: Lessons from Amazon and our customers - MAD...
 
How Millennium Management achieves provable security with AWS Zelkova - FSV30...
How Millennium Management achieves provable security with AWS Zelkova - FSV30...How Millennium Management achieves provable security with AWS Zelkova - FSV30...
How Millennium Management achieves provable security with AWS Zelkova - FSV30...
 
Safeguard the Integrity of Your Code for Fast and Secure Deployments - SVC206...
Safeguard the Integrity of Your Code for Fast and Secure Deployments - SVC206...Safeguard the Integrity of Your Code for Fast and Secure Deployments - SVC206...
Safeguard the Integrity of Your Code for Fast and Secure Deployments - SVC206...
 
Cloud Operating Models for Accelerated Cloud Transformation - AWS Summit Sydney
Cloud Operating Models for Accelerated Cloud Transformation - AWS Summit SydneyCloud Operating Models for Accelerated Cloud Transformation - AWS Summit Sydney
Cloud Operating Models for Accelerated Cloud Transformation - AWS Summit Sydney
 
Safeguarding the integrity of your code for fast, secure deployments - SVC301...
Safeguarding the integrity of your code for fast, secure deployments - SVC301...Safeguarding the integrity of your code for fast, secure deployments - SVC301...
Safeguarding the integrity of your code for fast, secure deployments - SVC301...
 
How Nubank is building a customer-obsessed bank - FSV201 - New York AWS Summit
How Nubank is building a customer-obsessed bank - FSV201 - New York AWS SummitHow Nubank is building a customer-obsessed bank - FSV201 - New York AWS Summit
How Nubank is building a customer-obsessed bank - FSV201 - New York AWS Summit
 
Finding all the threats: AWS threat detection and remediation - SEC303 - Chic...
Finding all the threats: AWS threat detection and remediation - SEC303 - Chic...Finding all the threats: AWS threat detection and remediation - SEC303 - Chic...
Finding all the threats: AWS threat detection and remediation - SEC303 - Chic...
 
Tools for building your MVP on AWS
Tools for building your MVP on AWSTools for building your MVP on AWS
Tools for building your MVP on AWS
 
Introduction to the Well-Architected Framework and Tool - SVC212 - Santa Clar...
Introduction to the Well-Architected Framework and Tool - SVC212 - Santa Clar...Introduction to the Well-Architected Framework and Tool - SVC212 - Santa Clar...
Introduction to the Well-Architected Framework and Tool - SVC212 - Santa Clar...
 
Are you Well Architected?
Are you Well Architected?Are you Well Architected?
Are you Well Architected?
 
AWS Summit Singapore 2019 | AWS Techfest Opening Keynote
AWS Summit Singapore 2019 | AWS Techfest Opening KeynoteAWS Summit Singapore 2019 | AWS Techfest Opening Keynote
AWS Summit Singapore 2019 | AWS Techfest Opening Keynote
 
Secure Your Data with Recommended Best Practices Enabled by AWS Security and ...
Secure Your Data with Recommended Best Practices Enabled by AWS Security and ...Secure Your Data with Recommended Best Practices Enabled by AWS Security and ...
Secure Your Data with Recommended Best Practices Enabled by AWS Security and ...
 
Security at Scale: Security Hub and the Well Architected Framework - AWS Summ...
Security at Scale: Security Hub and the Well Architected Framework - AWS Summ...Security at Scale: Security Hub and the Well Architected Framework - AWS Summ...
Security at Scale: Security Hub and the Well Architected Framework - AWS Summ...
 

More from Amazon Web Services

Come costruire servizi di Forecasting sfruttando algoritmi di ML e deep learn...
Come costruire servizi di Forecasting sfruttando algoritmi di ML e deep learn...Come costruire servizi di Forecasting sfruttando algoritmi di ML e deep learn...
Come costruire servizi di Forecasting sfruttando algoritmi di ML e deep learn...
Amazon Web Services
 
Big Data per le Startup: come creare applicazioni Big Data in modalità Server...
Big Data per le Startup: come creare applicazioni Big Data in modalità Server...Big Data per le Startup: come creare applicazioni Big Data in modalità Server...
Big Data per le Startup: come creare applicazioni Big Data in modalità Server...
Amazon Web Services
 
Esegui pod serverless con Amazon EKS e AWS Fargate
Esegui pod serverless con Amazon EKS e AWS FargateEsegui pod serverless con Amazon EKS e AWS Fargate
Esegui pod serverless con Amazon EKS e AWS Fargate
Amazon Web Services
 
Costruire Applicazioni Moderne con AWS
Costruire Applicazioni Moderne con AWSCostruire Applicazioni Moderne con AWS
Costruire Applicazioni Moderne con AWS
Amazon Web Services
 
Come spendere fino al 90% in meno con i container e le istanze spot
Come spendere fino al 90% in meno con i container e le istanze spot Come spendere fino al 90% in meno con i container e le istanze spot
Come spendere fino al 90% in meno con i container e le istanze spot
Amazon Web Services
 
Open banking as a service
Open banking as a serviceOpen banking as a service
Open banking as a service
Amazon Web Services
 
Rendi unica l’offerta della tua startup sul mercato con i servizi Machine Lea...
Rendi unica l’offerta della tua startup sul mercato con i servizi Machine Lea...Rendi unica l’offerta della tua startup sul mercato con i servizi Machine Lea...
Rendi unica l’offerta della tua startup sul mercato con i servizi Machine Lea...
Amazon Web Services
 
OpsWorks Configuration Management: automatizza la gestione e i deployment del...
OpsWorks Configuration Management: automatizza la gestione e i deployment del...OpsWorks Configuration Management: automatizza la gestione e i deployment del...
OpsWorks Configuration Management: automatizza la gestione e i deployment del...
Amazon Web Services
 
Microsoft Active Directory su AWS per supportare i tuoi Windows Workloads
Microsoft Active Directory su AWS per supportare i tuoi Windows WorkloadsMicrosoft Active Directory su AWS per supportare i tuoi Windows Workloads
Microsoft Active Directory su AWS per supportare i tuoi Windows Workloads
Amazon Web Services
 
Computer Vision con AWS
Computer Vision con AWSComputer Vision con AWS
Computer Vision con AWS
Amazon Web Services
 
Database Oracle e VMware Cloud on AWS i miti da sfatare
Database Oracle e VMware Cloud on AWS i miti da sfatareDatabase Oracle e VMware Cloud on AWS i miti da sfatare
Database Oracle e VMware Cloud on AWS i miti da sfatare
Amazon Web Services
 
Crea la tua prima serverless ledger-based app con QLDB e NodeJS
Crea la tua prima serverless ledger-based app con QLDB e NodeJSCrea la tua prima serverless ledger-based app con QLDB e NodeJS
Crea la tua prima serverless ledger-based app con QLDB e NodeJS
Amazon Web Services
 
API moderne real-time per applicazioni mobili e web
API moderne real-time per applicazioni mobili e webAPI moderne real-time per applicazioni mobili e web
API moderne real-time per applicazioni mobili e web
Amazon Web Services
 
Database Oracle e VMware Cloud™ on AWS: i miti da sfatare
Database Oracle e VMware Cloud™ on AWS: i miti da sfatareDatabase Oracle e VMware Cloud™ on AWS: i miti da sfatare
Database Oracle e VMware Cloud™ on AWS: i miti da sfatare
Amazon Web Services
 
Tools for building your MVP on AWS
Tools for building your MVP on AWSTools for building your MVP on AWS
Tools for building your MVP on AWSAmazon Web Services
 
How to Build a Winning Pitch Deck
How to Build a Winning Pitch DeckHow to Build a Winning Pitch Deck
How to Build a Winning Pitch DeckAmazon Web Services
 
Building a web application without servers
Building a web application without serversBuilding a web application without servers
Building a web application without serversAmazon Web Services
 
AWS_HK_StartupDay_Building Interactive websites while automating for efficien...
AWS_HK_StartupDay_Building Interactive websites while automating for efficien...AWS_HK_StartupDay_Building Interactive websites while automating for efficien...
AWS_HK_StartupDay_Building Interactive websites while automating for efficien...Amazon Web Services
 
Introduzione a Amazon Elastic Container Service
Introduzione a Amazon Elastic Container ServiceIntroduzione a Amazon Elastic Container Service
Introduzione a Amazon Elastic Container Service
Amazon Web Services
 

More from Amazon Web Services (20)

Come costruire servizi di Forecasting sfruttando algoritmi di ML e deep learn...
Come costruire servizi di Forecasting sfruttando algoritmi di ML e deep learn...Come costruire servizi di Forecasting sfruttando algoritmi di ML e deep learn...
Come costruire servizi di Forecasting sfruttando algoritmi di ML e deep learn...
 
Big Data per le Startup: come creare applicazioni Big Data in modalità Server...
Big Data per le Startup: come creare applicazioni Big Data in modalità Server...Big Data per le Startup: come creare applicazioni Big Data in modalità Server...
Big Data per le Startup: come creare applicazioni Big Data in modalità Server...
 
Esegui pod serverless con Amazon EKS e AWS Fargate
Esegui pod serverless con Amazon EKS e AWS FargateEsegui pod serverless con Amazon EKS e AWS Fargate
Esegui pod serverless con Amazon EKS e AWS Fargate
 
Costruire Applicazioni Moderne con AWS
Costruire Applicazioni Moderne con AWSCostruire Applicazioni Moderne con AWS
Costruire Applicazioni Moderne con AWS
 
Come spendere fino al 90% in meno con i container e le istanze spot
Come spendere fino al 90% in meno con i container e le istanze spot Come spendere fino al 90% in meno con i container e le istanze spot
Come spendere fino al 90% in meno con i container e le istanze spot
 
Open banking as a service
Open banking as a serviceOpen banking as a service
Open banking as a service
 
Rendi unica l’offerta della tua startup sul mercato con i servizi Machine Lea...
Rendi unica l’offerta della tua startup sul mercato con i servizi Machine Lea...Rendi unica l’offerta della tua startup sul mercato con i servizi Machine Lea...
Rendi unica l’offerta della tua startup sul mercato con i servizi Machine Lea...
 
OpsWorks Configuration Management: automatizza la gestione e i deployment del...
OpsWorks Configuration Management: automatizza la gestione e i deployment del...OpsWorks Configuration Management: automatizza la gestione e i deployment del...
OpsWorks Configuration Management: automatizza la gestione e i deployment del...
 
Microsoft Active Directory su AWS per supportare i tuoi Windows Workloads
Microsoft Active Directory su AWS per supportare i tuoi Windows WorkloadsMicrosoft Active Directory su AWS per supportare i tuoi Windows Workloads
Microsoft Active Directory su AWS per supportare i tuoi Windows Workloads
 
Computer Vision con AWS
Computer Vision con AWSComputer Vision con AWS
Computer Vision con AWS
 
Database Oracle e VMware Cloud on AWS i miti da sfatare
Database Oracle e VMware Cloud on AWS i miti da sfatareDatabase Oracle e VMware Cloud on AWS i miti da sfatare
Database Oracle e VMware Cloud on AWS i miti da sfatare
 
Crea la tua prima serverless ledger-based app con QLDB e NodeJS
Crea la tua prima serverless ledger-based app con QLDB e NodeJSCrea la tua prima serverless ledger-based app con QLDB e NodeJS
Crea la tua prima serverless ledger-based app con QLDB e NodeJS
 
API moderne real-time per applicazioni mobili e web
API moderne real-time per applicazioni mobili e webAPI moderne real-time per applicazioni mobili e web
API moderne real-time per applicazioni mobili e web
 
Database Oracle e VMware Cloud™ on AWS: i miti da sfatare
Database Oracle e VMware Cloud™ on AWS: i miti da sfatareDatabase Oracle e VMware Cloud™ on AWS: i miti da sfatare
Database Oracle e VMware Cloud™ on AWS: i miti da sfatare
 
Tools for building your MVP on AWS
Tools for building your MVP on AWSTools for building your MVP on AWS
Tools for building your MVP on AWS
 
How to Build a Winning Pitch Deck
How to Build a Winning Pitch DeckHow to Build a Winning Pitch Deck
How to Build a Winning Pitch Deck
 
Building a web application without servers
Building a web application without serversBuilding a web application without servers
Building a web application without servers
 
Fundraising Essentials
Fundraising EssentialsFundraising Essentials
Fundraising Essentials
 
AWS_HK_StartupDay_Building Interactive websites while automating for efficien...
AWS_HK_StartupDay_Building Interactive websites while automating for efficien...AWS_HK_StartupDay_Building Interactive websites while automating for efficien...
AWS_HK_StartupDay_Building Interactive websites while automating for efficien...
 
Introduzione a Amazon Elastic Container Service
Introduzione a Amazon Elastic Container ServiceIntroduzione a Amazon Elastic Container Service
Introduzione a Amazon Elastic Container Service
 

Threat detection and mitigation at AWS - SEC201 - Atlanta AWS Summit

  • 1. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T The Zen of governance: Establish guardrails and empower builders Sam Hennessy Solutions architect Amazon Web Services S V C 2 0 1
  • 2. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T Once upon a time …
  • 3. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T The story W al l Product owners IT operationsDevelopers W al l W al l W al l QA Security 1 2 1 3 4 5 6 6
  • 4. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T Competing priorities Lack of understanding Wildly different environments No singular tool chain Slow Repetitive workflows Lack of security influence Everyone is frustrated (usually with each other) Does this work?
  • 5. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T Just do DevOps
  • 6. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T Who is responsible for what Responsible for Their product Deployment tools CI/CD tools Monitoring tools Metrics tool Logging tools APM tools Infrastructure provisioning tools Security tools Database management tools Testing tools …. Not responsible for
  • 7. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T Who does QA? • The team Who is responsible to deliver a secure product? • The team Who is responsible to operate and maintain the product? • The team Who is responsible for production failures and issues (on call)? • The team Who is responsible for monitoring, logging, and application analysis? • The team Do you see a pattern? Who is responsible for what
  • 8. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T This will solve all my problems? Not quite …
  • 9. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T The challenges Training Tools Processes Bottlenecks
  • 10. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T Training Quality Security Operations
  • 11. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T The bottlenecks Security and compliance validation Software release Infrastructure provisioning Account provisioning
  • 12. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T Self service is the key to scalability
  • 13. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T You want to let whom do what?
  • 14. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T Guardrails to the rescue Secure SDLC (sSDLC) Separation of duties Logging
  • 15. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T Guardrails enablement tools
  • 16. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T sSDLC: Software guardrails Code review Authorization controls Security testing Separation of duties Security monitoring Audit trail Security training
  • 17. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T Separation of duties: Isolation guardrails Account throttling and limits Minimal permission Reduce blast effect Framework compliance
  • 18. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T Separation of duties: Tools and processes Tools should be managed like internal services Teams should manage the access and availability of the tools, not their use Ask why self-service cannot be used, instead of why it should be used
  • 19. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T Separation of duties: Production AWS Cloud Shared services CI/CD tools QA Staging Production Logging and change control
  • 20. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T Logging: Tracking guardrails Change control Centralized collection Don’t just let logs sit there
  • 21. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T Guardrails at scale
  • 22. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T Multi-account Centralized management Access administration Easy auditing Security assets AWS Cloud Organizations Master Shared services Security and logging
  • 23. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T Multi-account: Provisioning Organizations Homegrown AWS Landing Zones AWS Control Tower Amazon CloudWatchIAMAWS CloudTrail AWS Systems Manager documents
  • 24. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T Multi-account: Continuous compliance AWS Config AWS Systems Manager AWS CloudFormation drift detection AWS CloudTrail
  • 25. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T Multi-account: Example AWS Cloud AWS Organizations Master Security Shared SCPs AWS Landing Zone AWS Control Tower Homegrown Application accounts AWS Service Catalog AWS Config AWS Systems Manager Shared production tools AWS CloudTrail
  • 26. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T Resource provisioning Should be part of CI/CD process AWS CloudFormation AWS Service Catalog AWS OpsWorks
  • 27. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T Resource provisioning: Processes ReleaseBuildSource Testing Security peer review static code analysis linters style guides Testing Security unit testing • functional • security Testing Security integration testing performanace testing UAT pen/vuln testing smoke testing AWS CodePipeline AWS CodeBuild AWS CodeCommit AWS CodeDeploy
  • 28. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T Recap DevOps is a good starting point Self-service is the key to enablement Multi-account tooling Centralized governance; tighten controls to loosen innovation
  • 29. Thank you! S U M M I T © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. Sam Hennessy