Downloaded 65 times
![S U M M I T © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.
CloudWatchEvents
{
"source": [
"aws.guardduty"
]
}
CloudWatch Event
GuardDuty
findings
Lambda
function](https://image.slidesharecdn.com/small-190713013952/75/Threat-detection-and-mitigation-at-AWS-29-2048.jpg)
Uploaded byNathan Case
Threat detection and mitigation at AWS
The document outlines AWS tools and services for threat detection and mitigation, emphasizing the integration of services like AWS GuardDuty, CloudTrail, and Security Hub for monitoring AWS accounts and workloads. It discusses the complexities of traditional threat detection and highlights the need for automated compliance and visibility into cloud resources. Additionally, it details response strategies, including automated incident response through AWS Lambda and Systems Manager.
![Vibe Coding vs. Spec-Driven Development [Free Meetup]](https://cdn.slidesharecdn.com/ss_thumbnails/vibecodingvsspecdrivendevelopment-251209105622-43f455e7-thumbnail.jpg?width=640&height=640&fit=bounds)
Threat detection and mitigation at AWS
- 1. S U MM I T NE W YORK
- 2. © 2019, AmazonWeb Services, Inc. or its affiliates. All rights reserved.S U M M I T Threat detection and mitigation in AWS Nathan Case Sr. Solutions Architect, Security Specialist Amazon Web Services S E C 2 0 1
- 3. © 2019, AmazonWeb Services, Inc. or its affiliates. All rights reserved.S U M M I T © 2018, Amazon Web Services, Inc. or Its Affiliates. All rights reserved. AWS IAM AWS Organizations AWS Cognito AWS Directory Service AWS Single Sign-On AWS CloudTrail AWS Config Amazon CloudWatch Amazon GuardDuty VPC Flow Logs Amazon EC2 Systems Manager AWS Shield AWS WAF Amazon Inspector Amazon VPC AWS KMS AWS CloudHSM Amazon Macie AWS Certificate Manager Server-side encryption AWS Config rules AWS Lambda AWS Enterprise Support Identity Detective control Infrastructure security Incident response Data protection AWS security solutions
- 4. © 2019, AmazonWeb Services, Inc. or its affiliates. All rights reserved.S U M M I T AWS securityservicesoverview Protect Detect Respond Automate Investigate RecoverIdentify ArchiveSnapshot
- 5. © 2019, AmazonWeb Services, Inc. or its affiliates. All rights reserved.S U M M I T Why is traditional threat detection so hard? CostSignal to noiseLarge datasets
- 6. © 2019, AmazonWeb Services, Inc. or its affiliates. All rights reserved.S U M M I T Humans and data donʼt mix
- 7. S U MM I T © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.
- 8. © 2019, AmazonWeb Services, Inc. or its affiliates. All rights reserved.S U M M I T CloudTrail Track user activity and API usage VPC Flow Logs IP traffic to/from network interfaces in your VPC Amazon CloudWatch Logs Monitor apps using log data, store, and access log files DNS logs Log of DNS queries in a VPC when using the VPC DNS resolver Threatdetection: Log datainputs
- 9. S U MM I T © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. CloudTrail
- 10. S U MM I T © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. DetectwithVPCFlowLogs AWS account Source IP Destination IP Source port Destination port Interface Protocol Packets Bytes Start and end time Accept or reject
- 11. S U MM I T © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. • Real-time feed of log events • Delivered to an Lambda function or an Amazon Kinesis data streams • Supports custom processing, analysis, and loading into other systems • Cross-account data sharing for centralized log processing CloudWatchLogs subscriptions
- 12. S U MM I T © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.
- 13. © 2019, AmazonWeb Services, Inc. or its affiliates. All rights reserved.S U M M I T GuardDuty Intelligent threat detection and continuous monitoring to protect your AWS accounts and workloads AWS Security Hub Security Hub gives you a comprehensive view of your high-priority security alerts and compliance status across AWS accounts. Threatdetection
- 14. S U MM I T © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. GuardDuty threatdetection and notification
- 15. © 2019, AmazonWeb Services, Inc. or its affiliates. All rights reserved.S U M M I T SecurityHub overview
- 16. © 2019, AmazonWeb Services, Inc. or its affiliates. All rights reserved.S U M M I T SecurityHubbenefits Managed regional AWS service; aggregates findings across AWS accounts in minutes Manage security and compliance findings in a single location, increasing efficiency of locating relevant data Create custom insights to track issues unique to your environment
- 17. © 2019, AmazonWeb Services, Inc. or its affiliates. All rights reserved.S U M M I T SecurityHubworkflow Enable Security Hub for all your accounts Account 1 Account 2 Account 3 Conduct automated compliance scans and checks Take action based on findings Continuously aggregate and prioritize findings
- 18. © 2019, AmazonWeb Services, Inc. or its affiliates. All rights reserved.S U M M I T Compliance standards • Based on CIS AWS Foundations Benchmark • Findings are displayed on main dashboard for quick access • Best-practices information is provided to help mitigate issues Compliance standards
- 19. © 2019, AmazonWeb Services, Inc. or its affiliates. All rights reserved.S U M M I T SecurityHubinsights Security findings that are correlated and grouped for prioritization • More than 20 prebuilt insights provided by AWS and AWS Partner Network members • Ability to create your own insights • Dashboard provides visibility into the top security findings • Additional details for each finding is available for review EC2 instances that have missing security patches S3 buckets with stored credentials S3 buckets with public read and write permissions
- 20. S U MM I T © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. Whatcan youdetectusingAWS services? Infrastructure VPC resources Connectivity On-instance ... Service IAM S3 buckets Billing ... Application Patching Coding hole ... Other?
- 21. S U MM I T © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. Availability Zone C Availability Zone B VPC CIDR: 10.0.0.0/16 Availability Zone A 10.0.0.0/19 Public subnet 10.0.32.0/20 Private subnet 10.0.48.0/21 Sensitive subnet Security groups Route table NACLs Internet gateway Instance Amazon S3 Amazon RDS AWS IAM AWS CloudHSM AWS Organizations AWSKMS AWS Directory Service Infrastructure and applicationdomains
- 22. S U MM I T © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. Services Domain Availability Zone C Availability Zone B VPC CIDR: 10.0.0.0/16 Availability Zone A 10.0.0.0/19 Public subnet 10.0.32.0/20 Private subnet 10.0.48.0/21 Sensitive subnet Security groups Route table NACLs Internet gateway Instance Amazon S3 Amazon RDS AWS IAM AWS CloudHSM AWS Organizations AWSKMS AWS Directory Service Servicesdomains
- 23. S U MM I T © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. All Domains Availability Zone C Availability Zone B VPC CIDR: 10.0.0.0/16 Availability Zone A 10.0.0.0/19 Public subnet 10.0.32.0/20 Private subnet 10.0.48.0/21 Sensitive subnet Security groups Route table NACLs Internet gateway Instance Amazon S3 Amazon RDS AWS IAM AWS CloudHSM AWS Organizations AWSKMS AWS Directory Service Whatcan youdetectusingAWS services?
- 24. © 2019, AmazonWeb Services, Inc. or its affiliates. All rights reserved.S U M M I T Visibilitytoanswerthetoughquestions • What data do I have in the cloud? • Where is it located? • Where does my sensitive data exist? • What’s sensitive about the data? • What PII/PHI is possibly exposed? • How is data being shared and stored? • How and where is my data accessed? • How can I classify data in near-real time? • How do I build workflow remediation for my security and compliance needs?
- 25. © 2019, AmazonWeb Services, Inc. or its affiliates. All rights reserved.S U M M I T Visibilitytoanswerthetoughquestions Amazon Web Services has opened case ******** on your behalf. The details of the case are as follows: Case ID: ******** Subject: Your AWS account ******** is compromised Severity: Urgent Correspondence: Dear AWS Customer, Your AWS Account is compromised! Please review the following notice and take immediate action to secure your account. Your security is important to us. We have become aware that the AWS Access Key ******** along with the corresponding Secret Key is publicly available online at ********…
- 26. S U MM I T © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.
- 27. © 2019, AmazonWeb Services, Inc. or its affiliates. All rights reserved.S U M M I T Amazon CloudWatch Events Delivers a near-real-time stream of system events that describe changes in AWS resources AWS Config rules Continuously tracks your resource configuration changes and if they violate any of the conditions in your rules Threatdetection:Triggers
- 28. © 2019, AmazonWeb Services, Inc. or its affiliates. All rights reserved.S U M M I T AWSConfig rules A continuous recording and assessment service Changing resources AWS Config AWS Config rules History snapshot Notifications API access Normalized • How are my resources configured over time? • Is a change that just occurred to a resource compliant?
- 29. S U MM I T © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. CloudWatchEvents { "source": [ "aws.guardduty" ] } CloudWatch Event GuardDuty findings Lambda function
- 30. S U MM I T © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.
- 31. © 2019, AmazonWeb Services, Inc. or its affiliates. All rights reserved.S U M M I T AWS Systems Manager Automate patching and proactively mitigate threats at the instance level Lambda Capture info about the IP traffic going to and from network interfaces in your VPC Threatremediation:Automation
- 32. S U MM I T © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. High-level playbook Adversary or intern Your environment Lambda responder CloudWatch Events AWS Step Functions
- 33. S U MM I T © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. CloudWatch CloudTrail AWS Config Lambda function AWS APIs AWS WAF AWS Shield Detection Alerting Remediation Countermeasures Forensics Team collaboration (Slack, etc.) GuardDuty VPC Flow Logs Step Functions Systems Manager Amazon EC2 Responding tofindings: Remediation
- 34. S U MM I T © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.
- 35. © 2019, AmazonWeb Services, Inc. or its affiliates. All rights reserved.S U M M I T Hopefully,you'veseenthisalready Developer sandbox Dev Pre-prod Team/group accounts Security Core accounts AWS Organizations Shared services Network Log archive Prod Team shared services Network path Developer accounts Data center Orgs: Account management Log archive: Security logs Security: Security tools, AWS Config rules Shared services: Directory, limit monitoring Network: AWS Direct Connect Dev sandbox: Experiments, learning Dev: Development Pre-prod: Staging Prod: Production Team SS: Team shared services, data lake
- 36. © 2019, AmazonWeb Services, Inc. or its affiliates. All rights reserved.S U M M I T Services Security Core accounts AWS Organizations Shared services Network Log archive Network path Data center Orgs: Account management Log archive: Security logs Security: Security tools, AWS Config rules Shared services: Directory, limit monitoring Network: DX Dev sandbox: Experiments, learning Dev: Development Pre-prod: Staging Prod: Production Team SS: Team shared services, data lake
- 37. © 2019, AmazonWeb Services, Inc. or its affiliates. All rights reserved.S U M M I T Developers Developer sandbox Team/group accounts AWS Organizations Network path Developer accounts Data center Orgs: Account management Log archive: Security logs Security: Security tools, AWS Config rules Shared services: Directory, limit monitoring Network: DX Dev sandbox: Experiments, learning Dev: Development Pre-prod: Staging Prod: Production Team SS: Team shared services, data lake
- 38. © 2019, AmazonWeb Services, Inc. or its affiliates. All rights reserved.S U M M I T Connections toteamaccounts Developer sandbox Team/group accounts AWS Organizations Network path Developer accounts Data center Orgs: Account management Log archive: Security logs Security: Security tools, AWS Config rules Shared services: Directory, limit monitoring Network: DX Dev sandbox: Experiments, learning Dev: Development Pre-prod: Staging Prod: Production Team SS: Team shared services, data lake Core accounts Dev Pre-prod Team/group accounts Prod Team shared services
- 39. © 2019, AmazonWeb Services, Inc. or its affiliates. All rights reserved.S U M M I T Teamversusproduction accounts Dev Prod green Team/group accounts Prod blue Dev pipeline account Network path Data center Orgs: Account management Log archive: Security logs Security: Security tools, AWS Config rules Shared services: Directory, limit monitoring Network: DX Dev sandbox: Experiments, learning Dev: Development Pre-prod: Staging Prod: Production Team SS: Team shared services, data lake Testing account Prod pipeline account Network Prod/group accounts
- 40. S U MM I T © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.
- 42. S U MM I T © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.
- 43. © 2019, AmazonWeb Services, Inc. or its affiliates. All rights reserved.S U M M I T © 2018, Amazon Web Services, Inc. or Its Affiliates. All rights reserved. Lambda + Systems Manager + CloudWatch AWS Systems Manager documents Amazon CloudWatch rule AWS Lambda Lambda function AWS Step Functions Amazon GuardDuty AWS Security Hub
- 44. © 2019, AmazonWeb Services, Inc. or its affiliates. All rights reserved.S U M M I T © 2018, Amazon Web Services, Inc. or Its Affiliates. All rights reserved. Lambda + Systems Manager + CloudWatch AWS Systems Manager documents Amazon CloudWatch rule AWS Lambda Lambda function AWS Step Functions BACKDOOR:EC2/XORDDOS Amazon GuardDuty AWS Security Hub
- 45. © 2019, AmazonWeb Services, Inc. or its affiliates. All rights reserved.S U M M I T © 2018, Amazon Web Services, Inc. or Its Affiliates. All rights reserved. Lambda + Systems Manager + CloudWatch AWS Systems Manager documents Amazon CloudWatch rule AWS Lambda Lambda function AWS Step Functions GUARD DUTY FINDINGS Amazon GuardDuty AWS Security Hub
- 46. © 2019, AmazonWeb Services, Inc. or its affiliates. All rights reserved.S U M M I T © 2018, Amazon Web Services, Inc. or Its Affiliates. All rights reserved. Lambda + Systems Manager + CloudWatch AWS Systems Manager documents Amazon CloudWatch rule AWS Lambda Lambda function AWS Step Functions BACKDOOR:EC2/XORDDOS Amazon GuardDuty AWS Security Hub
- 47. © 2019, AmazonWeb Services, Inc. or its affiliates. All rights reserved.S U M M I T © 2018, Amazon Web Services, Inc. or Its Affiliates. All rights reserved. Lambda + Systems Manager + CloudWatch AWS Systems Manager documents Amazon CloudWatch rule AWS Lambda Lambda function AWS Step Functions BACKDOOR:EC2/XORDDOS COMMUNITCATIONS MANUAL ACTION Amazon GuardDuty AWS Security Hub
- 48. © 2019, AmazonWeb Services, Inc. or its affiliates. All rights reserved.S U M M I T © 2018, Amazon Web Services, Inc. or Its Affiliates. All rights reserved. Lambda + Systems Manager + CloudWatch AWS Systems Manager documents Amazon CloudWatch rule AWS Lambda Lambda function AWS Step Functions BACKDOOR:EC2/XORDDOS COMMUNITCATIONS MANUAL ACTION Via Amazon API Gateway* Amazon GuardDuty AWS Security Hub
- 49. © 2019, AmazonWeb Services, Inc. or its affiliates. All rights reserved.S U M M I T © 2018, Amazon Web Services, Inc. or Its Affiliates. All rights reserved. Lambda + Systems Manager + CloudWatch AWS Systems Manager documents Amazon CloudWatch rule EC2 instance contents Instance:~ ec2-user$ AWS Lambda Lambda function AWS Step Functions BACKDOOR:EC2/XORDDOS elastic network interface Security Group EBS Volume IAM Profile Amazon GuardDuty AWS Security Hub
- 50. © 2019, AmazonWeb Services, Inc. or its affiliates. All rights reserved.S U M M I T © 2018, Amazon Web Services, Inc. or Its Affiliates. All rights reserved. Lambda + Systems Manager + CloudWatch AWS Systems Manager documents Amazon CloudWatch rule AWS Lambda Lambda function AWS Step Functions BACKDOOR:EC2/XORDDOS Amazon GuardDuty AWS Security Hub
- 51. © 2019, AmazonWeb Services, Inc. or its affiliates. All rights reserved.S U M M I T © 2018, Amazon Web Services, Inc. or Its Affiliates. All rights reserved. Lambda + Systems Manager + CloudWatch AWS Systems Manager documents Amazon CloudWatch rule EC2 instance contents Instance:~ ec2-user$ AWS Lambda Lambda function AWS Step Functions BACKDOOR:EC2/XORDDOS elastic network interface Security Group EBS Volume IAM Profile EBS SNapshot Amazon GuardDuty AWS Security Hub
- 52. © 2019, AmazonWeb Services, Inc. or its affiliates. All rights reserved.S U M M I T © 2018, Amazon Web Services, Inc. or Its Affiliates. All rights reserved. Lambda + Systems Manager + CloudWatch AWS Systems Manager documents Amazon CloudWatch rule EC2 instance contents Instance:~ ec2-user$ AWS Lambda Lambda function AWS Step Functions BACKDOOR:EC2/XORDDOS elastic network interface Security Group EBS Volume IAM Profile Amazon S3 bucket AWS CloudTrail EBS Snapshot Amazon GuardDuty AWS Security Hub
- 53. © 2019, AmazonWeb Services, Inc. or its affiliates. All rights reserved.S U M M I T © 2018, Amazon Web Services, Inc. or Its Affiliates. All rights reserved. Lambda + Systems Manager + CloudWatch AWS Systems Manager documents Amazon CloudWatch rule EC2 instance contents Instance:~ ec2-user$ AWS Lambda Lambda function AWS Step Functions BACKDOOR:EC2/XORDDOS elastic network interface Security Group EBS Volume IAM Profile EBS Snapshot AWS CloudTrail Amazon S3 bucket Forensics Account Amazon GuardDuty AWS Security Hub
- 54. © 2019, AmazonWeb Services, Inc. or its affiliates. All rights reserved.S U M M I T © 2018, Amazon Web Services, Inc. or Its Affiliates. All rights reserved. Lambda + Systems Manager + CloudWatch AWS Systems Manager documents Amazon CloudWatch rule EC2 instance contents Instance:~ ec2-user$ AWS Lambda Lambda function AWS Step Functions BACKDOOR:EC2/XORDDOS Amazon GuardDuty AWS Security Hub
- 55. © 2019, AmazonWeb Services, Inc. or its affiliates. All rights reserved.S U M M I T © 2018, Amazon Web Services, Inc. or Its Affiliates. All rights reserved. Lambda + Systems Manager + CloudWatch AWS Systems Manager documents Amazon CloudWatch rule EC2 instance contents Instance:~ ec2-user$ Instance:~ ec2-user$ top Instance:~ ec2-user$ pcap Instance:~ ec2-user$ lime Instance:~ ec2-user$ dd AWS Lambda Lambda function AWS Step Functions BACKDOOR:EC2/XORDDOS EBS Volume IAM Profile Amazon GuardDuty AWS Security Hub
- 56. © 2019, AmazonWeb Services, Inc. or its affiliates. All rights reserved.S U M M I T © 2018, Amazon Web Services, Inc. or Its Affiliates. All rights reserved. Lambda + Systems Manager + CloudWatch AWS Systems Manager documents Amazon CloudWatch rule EC2 instance contents Instance:~ ec2-user$ Instance:~ ec2-user$ top Instance:~ ec2-user$ pcap Instance:~ ec2-user$ lime Instance:~ ec2-user$ dd AWS Lambda Lambda function AWS Step Functions BACKDOOR:EC2/XORDDOS EBS Volume Forensics EBS IAM Profile Amazon GuardDuty AWS Security Hub
- 57. © 2019, AmazonWeb Services, Inc. or its affiliates. All rights reserved.S U M M I T © 2018, Amazon Web Services, Inc. or Its Affiliates. All rights reserved. Lambda + Systems Manager + CloudWatch AWS Systems Manager documents Amazon CloudWatch rule AWS Lambda Lambda function AWS Step Functions BACKDOOR:EC2/XORDDOS Forensics EBS EBS Snapshot Amazon S3 bucket Forensics Account Amazon GuardDuty AWS Security Hub
- 58. © 2019, AmazonWeb Services, Inc. or its affiliates. All rights reserved.S U M M I T © 2018, Amazon Web Services, Inc. or Its Affiliates. All rights reserved. Lambda + Systems Manager + CloudWatch AWS Systems Manager documents Amazon CloudWatch rule AWS Lambda Lambda function AWS Step Functions BACKDOOR:EC2/XORDDOS Forensics EBS EBS Snapshot Amazon S3 bucket Forensics Account Amazon GuardDuty AWS Security Hub
- 59. S U MM I T © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. Lambda + Systems Manager + CloudWatch AWS Systems Manager documents Amazon CloudWatch rule AWS Lambda Lambda function AWS Step Functions BACKDOOR:EC2/XORDDOS Forensics EBS EBS Snapshot Amazon S3 bucket Forensics Account EASIER DONE THAN SAID. Amazon GuardDuty AWS Security Hub
- 60. S U MM I T © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.
- 61. © 2019, AmazonWeb Services, Inc. or its affiliates. All rights reserved.S U M M I T CloudWatch CloudTrail AWS Config Lambda function AWS APIs AWS WAF AWS Shield Detection Alerting Remediation Countermeasures Forensics Team collaboration (Slack, etc.) GuardDuty VPC Flow Logs Step Functions Systems Manager Amazon EC2 Responding tofindings: Remediation
- 62. © 2019, AmazonWeb Services, Inc. or its affiliates. All rights reserved.S U M M I T Remediating threats on EC2 instances • Asynchronously execute commands • No need to SSH/RDP • Commands and output logged Systems Manager – Run command EC2 instances Lambda function Systems Manager Amazon EC2
- 63. © 2019, AmazonWeb Services, Inc. or its affiliates. All rights reserved.S U M M I T Open-source resources Prowler https://github.com/toniblyx/prowler Cloud Custodian https://github.com/capitalone/cloud-custodian Security Monkey https://github.com/Netflix/security_monkey Scout2 https://github.com/nccgroup/Scout2 StreamAlert https://github.com/airbnb/streamalert CIS AWS Foundations Framework https://github.com/awslabs/aws-security-benchmark MozDef https://github.com/mozilla/MozDef
- 64. Thank you! S UM M I T © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. Nathan Case Sr. Solutions Architect, Security Specialist Amazon Web Services https://www.linkedin.com/in/nathancase/
- 65. S U MM I T © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved. Please complete the session survey in the mobile app. 1. Tap the Catalog icon. 2. Filter by Show Past Sessions. 3. Select the session that you attended. 4. Tap Complete an Evaluation to submit your feedback. Complete three surveys, and you’ll receive a gift at the Help Desk.