This workshop is designed to expose you to a number of AWS services that can be part of a threat detection and remediation strategy. We will cover the following services: Amazon GuardDuty, Amazon Macie, Amazon Inspector, Amazon CloudWatch (Events & Logs), AWS Lambda, Amazon SNS, Amazon S3, VPC Flow Logs, DNS Logs and AWS CloudTrail. You will learn how to use these services to set up a notification and remediation pipeline, to investigate threats during and after an attack, and how to evaluate what additional alerts and automated remediations should be deployed. We will go through a simulated attack scenario that will generate real GuardDuty findings and Macie alerts. We will investigate the attack, examine the threats, remediate the attack and investigate additional automated remediations that can be used in the future. Level: 200 Speaker: Sean Leviseur - Security Architect, AWS Professional Services

1. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Sean Leviseur, Senior Security Consultant
October 24th 2018
Threat Detection and Remediation
Workshop
Module 1

2. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Workshop agenda
• Quick introduction to the workshop
• Module 1: Environment build and configuration (20 min)
• Run CloudFormation template and some setup
• Module 2: Attack simulation (and presentation) (40 min)
• Run CloudFormation template
• Presentation
• Module 3: Detection and remediation (45 min)
• Investigate the attack
• Module 4: Review and discussion (15 min)
• Presentation / group Q&A
• Cleanup

3. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Verizon Report
Source: 2018 Data Breach Investigation Report, Verizon, 11th edition 2018
Verizon - 2018 Data Breach Investigations Report
Data Breach Patterns

4. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
What could
possibly go
wrong here?

5. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Start module 1
https://tinyurl.com/y84cc3pj
(https://github.com/aws-samples/aws-security-workshops/tree/master/threat-detection-wksp)
Directions:
• Browse to https://tinyurl.com/y84cc3pj
• Read through the workshop scenario
• Click on Environment Build and Configuration at the end
• Complete module (~15 min) then stop
• We will later start module 2 and do a presentation
use
us-west-2

6. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Start module 1 – Important!
https://tinyurl.com/y84cc3pj
(https://github.com/aws-samples/aws-security-workshops/tree/master/threat-detection-wksp)
use
us-west-2

7. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Sean Leviseur, Senior Security Consultant
October 24th 2018
Threat Detection and Remediation
Workshop
Module 2

8. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Agenda
• Module 2: Run the CloudFormation template (~5 min)
• Threat detection and remediation intro presentation
(~25 min)
• Workshop walkthrough (~10 min)

9. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Start module 2
https://tinyurl.com/y84cc3pj
(https://github.com/aws-samples/aws-security-workshops/tree/master/threat-detection-wksp)
Directions:
• Browse to https://tinyurl.com/y84cc3pj
• Click on Attack Simulation at the end
• Complete this module (~5 min) then stop
• We will then do a presentation
use
us-west-2

10. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.© 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Threat Detection and
Remediation Intro

11. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Why is threat detection so hard?
Skills shortageSignal to noiseLarge datasets

12. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Get humans away from the data and analysis
AWS CISO Stephen Schmidt, at re:Invent 2017: “It's people who make mistakes, it's people who have good
intentions but get phished, it's people who use the same credentials in multiple locations and don't use a hardware
token for a multi-factor authentication… Get the humans away from the data.”

13. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Detecting breaches
Source: 2018 Data Breach Investigation Report, Verizon, 11th edition 2018

14. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Top Actions Taken to Address Security Issues
Source: 2017 Forbes Insights – “Enterprises Reengineer Security in the Age of Digital Transformation”
2017 Forbes Insights –
“Enterprises Reengineer
Security in the Age of
Digital Transformation”
Source: 2017 Forbes Insights – “Enterprises Reengineer Security in the Age of Digital Transformation”

15. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
AWS CloudTrail
AWS Config Rules
Amazon
CloudWatch Logs
Amazon GuardDuty
VPC Flow Logs
Amazon Macie
AWS Shield
AWS WAF
AWS
Systems Manager
Amazon Inspector
VPC
KMS
AWS CloudHSM
IAM
AWS Organizations
AWS Cognito
AWS Directory Service
AWS Single Sign-On
Certificate Manager
Amazon Inspector
AWS Config Rules
AWS Lambda
AWS
Systems Manager
Amazon
CloudWatch Events
Pro Services Raptor
Protect RespondDetect RecoverIdentify
AWS Lambda
AWS DR and Backup
Solutions
AWS
Systems Manager
AWS Config
AWS Security Solutions https://www.nist.gov/cyberframework

16. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.© 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Threat Detection Services

17. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Threat Detection: Log Data Inputs
AWS CloudTrail VPC Flow Logs CloudWatch Logs DNS Logs
Track user
activity and
API usage
IP traffic to/from
network
interfaces in your
VPC
Monitor apps
using log data,
store & access log
files
Log of DNS
queries in a VPC
when using the
VPC DNS resolver

18. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Threat Detection: Machine Learning
Amazon
GuardDuty
Intelligent threat detection
and continuous monitoring
to protect your AWS
accounts and workloads
Amazon Macie
Machine learning-powered
security service to discover,
classify & protect sensitive data

19. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Amazon GuardDuty

20. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
What Can Amazon GuardDuty Detect?
RDP brute
force
RAT
Installed
Exfiltrate
data over
DNS
Probe API
with temp
creds
Attempt to
compromise
account
Malicious or
suspicious IP
Unusual ports
DNS exfiltration
Unusual traffic volume
Connect to blacklisted site
Recon
Anonymizing proxy
Temp credentials
used off-instance
Unusual ISP caller
Bitcoin activity
Unusual instance launch

21. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Threat Detection: Evocations/Triggers
Amazon CloudWatch
Events
Delivers a near real-time stream
of system events that describe
changes in AWS resources
AWS Config rules
Continuously tracks your
resource configuration changes
and if they violate any of the
conditions in your rules

22. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Amazon CloudWatch Events
{
"source": [
"aws.guardduty"
]
}
CloudWatch
Event
GuardDuty
findings
Lambda
function

23. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.© 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Threat Remediation Services

24. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Threat Remediation Services
AWS Systems
Manager
AWS
Lambda
Amazon
Inspector
Run code for virtually
any kind of application
or backend service –
zero administration
Gain operational
insights and take
action on AWS
resources
Automate security
assessments of EC2
instances

25. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
High-Level Playbook
Adversary
or intern
Your
environment
Lambda
function
CloudWatch
Events

26. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.© 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Workshop walkthrough

27. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
The initial
setup

28. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Module 1
setup

29. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Start module 3
https://tinyurl.com/y84cc3pj
(https://github.com/aws-samples/aws-security-workshops/tree/master/threat-detection-wksp)
Directions:
• Browse to https://tinyurl.com/y84cc3pj
• Click on Detection & Remediation at the end
• Run through this module (~45 min)
• We will then finish up with module 4 and cleanup
use
us-west-2

30. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Sean Leviseur, Senior Security Consultant
October 24th 2018
Threat Detection and Remediation
Workshop
Module 4 – Review, Discussion, Questions & Cleanup

31. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Agenda
• Review & Discussion – 5 min
• Questions – 15 min
• Cleanup

32. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.© 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Review & Discussion

33. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
The Attack

34. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Module 2
setup

35. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
What
really
happened?

36. © 2018, Amazon Web Services, Inc. or its Affiliates. All rights reserved.© 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Questions