You don’t need to be a security expert to protect your organisations data in the cloud. You don’t need to be a security expert to protect your workloads on AWS. You just need to be informed of the many security tools available in AWS, and learn how to use them. Taking a highly automated approach to security, you can use key features of the AWS Cloud to transform security in your organisation. As with infrastructure as an API, security as an API allows you to move rapidly & stay secure. From AWS security groups, to virtual private networks, to security tools, you need to learn how to automate and accelerate. In this talk, you’ll see how various AWS features and cloud-aware security controls can work together to protect your deployments. Using real-world examples, you’ll come away with an understanding of steps you can take to ensure that you maximise the security of your deployment while minimising the work it takes to keep it secure. You will learn a logical approach to modern security that you can immediately apply to your own AWS deployments. You will learn how to use security tools and techniques to help you build with confidence.

1. Using Security To Build
With Confidence In AWS
Sasha Pavlovic
Director, Cloud and Datacenter Security | APAC

2. The Story
More at aws.trendmicro.com
2012 re:Invent
SPR203 : Cloud Security is a Shared Responsibility
http://bit.ly/2012-spr203
2013 re:Invent
SEC208: How to Meet Strict Security & Compliance Requirements in the Cloud
http://bit.ly/2013-sec208
SEC307: How Trend Micro Build their Enterprise Security Offering on AWS
http://bit.ly/2013-sec307
2014 re:Invent
SEC313: Updating Security Operations for the Cloud
http://bit.ly/2014-sec313
SEC314: Customer Perspectives on Implementing Security Controls with AWS
http://bit.ly/2014-sec314

3. Shared Responsibility Model
AWS
Physical
Infrastructure
Network
Virtualisation
You
Operating System
Applications
Data
Service Configuration
More at aws.amazon.com/security

4. Shared Responsibility Model
AWS
Physical
Infrastructure
Network
Virtualisation
You
Operating System
Applications
Data
Service Configuration
Verify
More at aws.amazon.com/security

5. Vulnerability Respond Repair

6. Vulnerability
©2015,'Amazon'Web'Services,'Inc.'or'its'affiliates.'All'rights'reserved

7. by Andreas Lindh (@addelindh)

8. bash is a common command line interpreter

9. a:() { b; } | attack
10 | 10 vulnerability. Widespread & easy to exploit

10. Shellshock Impact

11. Shellshock Impact

12. Shellshock Impact

13. Fantastic summary by David A. Wheeler at http://www.dwheeler.com/essays/shellshock.html#timeline

14. 1989
Fantastic summary by David A. Wheeler at http://www.dwheeler.com/essays/shellshock.html#timeline

15. "MicroTAC" by Redrum0486 at English Wikipedia

16. "MicroTAC" by Redrum0486 at English Wikipedia
12.3oz

17. Time Since Last Event Event Action Action Timeline
1989$08$05'8:32 Added'to'codebase
27'days,'10:20:00 Released'to'public
9141'days,'21:18:35 Initial'report React Clock'starts
1'day,'22:19:13 More'details React
2 days, 7:30:12 Official patch :: CVE-2014-6271 Patch 4 days, 5:49:25
5'days,'9:16:35 Limited'disclosure'::'CVE$2014$6271 React
2'days,'4:37:25 More'details React
3:44:00 More'details React
0:27:51 Public'disclosure React
0:36:30 More'details React
0:34:39 Public'disclosure'::'CVE$2014$7169 React

18. 3:29:09 Official patch :: CVE-2014-7169 Patch 9 days, 19:17:00
1:09:00 More'details React
2:07:00 Mitigation'::'CVE$2014$7169 React
2:27:00 More'details React
23:50:00 More'details React
17:46:00 More'details React
7:24:00 More'details React
2'days,'7:21:00 Public'disclosure'::'CVE$2014$6277'&'CVE$2014$6278 React
0:11:00 More'details React
3:15:00 Official'patch'::'CVE/2014/7186,'CVE/2014/7187 Patch 4'days,'17:30:00
1 day, 11:55:00 Official'patch'::'CVE/2014/6277 Patch 1'day,'11:55:00
2'days,'20:24:00 Official'patch'::'CVE/2014/6278 Patch 2'days,'20:24:00

19. Important Shellshock Events
Time Since Last Event Event Action Action Timeline
1989$08$05'8:32 Added'to'codebase
27'days,'10:20:00 Released'to'public
9141'days,'21:18:35 Initial'report React Clock'starts
2 days, 7:30:12 Official patch :: CVE-2014-6271 Patch 4 days, 5:49:25
3:29:09 Official patch :: CVE-2014-7169 Patch 9 days, 19:17:00
3:15:00 Official'patch'::'CVE/2014/7186,'CVE/2014/7187 Patch 4'days,'17:30:00
1 day, 11:55:00 Official'patch'::'CVE/2014/6277 Patch 1'day,'11:55:00

20. Respond
©2015,'Amazon'Web'Services,'Inc.'or'its'affiliates.'All'rights'reserved
Day 1

21. aws.amazon.com/architecture : Web application hosting

22. aws.amazon.com/architecture : Web application hosting

23. TCP : 443TCP : 443 TCP : 4433TCP : 4433
Primary workflow for our deployment

24. AWS VPC Review

25. AWS VPC Review

26. AWS VPC Review

27. AWS VPC Checklist
Review
IAM roles
Security groups
Network segmentation
Network access control lists (NACL)
More in the Auditing Security Checklist for Use of AWS, media.amazonwebservices.com/AWS_Auditing_Security_Checklist.pdf

28. TCP : 443TCP : 443 TCP : 4433TCP : 4433
Primary workflow for our deployment

29. TCP : 443TCP : 443 TCP : 4433TCP : 4433
Primary workflow for our deployment

30. HTTPSTPS
Intrusion prevention can look at each packet and then take action depending on what it finds

31. HTTPSTPS
Intrusion prevention can look at each packet and then take action depending on what it finds

32. HTTPSHTTPS
Intrusion prevention can look at each packet and then take action depending on what it finds

33. HTTPSHTTPS
Intrusion prevention can look at each packet and then take action depending on what it finds

34. HTTPSHTTPS
Intrusion prevention can look at each packet and then take action depending on what it finds

35. aws.amazon.com/architecture : Web application hosting

36. aws.amazon.com/architecture : Web application hosting

37. aws.amazon.com/architecture : Web application hosting

38. Intrusion Prevention in Action

39. Intrusion Prevention in Action

40. Intrusion Prevention in Action

41. Review
All instances covered
Workload appropriate rules
Centrally managed
Security controls must scale out automatically with the deployment

42. Repair
©2015,'Amazon'Web'Services,'Inc.'or'its'affiliates.'All'rights'reserved
Day 2

43. aws.amazon.com/architecture : Web application hosting

44. All instances deployment from task-specific AMI
TCP : 443TCP : 443 TCP : 4433TCP : 4433

45. All instances deployment from task-specific AMI
TCP : 443TCP : 443 TCP : 4433TCP : 4433

46. Workflow should be completely automated
Instantiate

47. Workflow should be completely automated
Instantiate Configure
AMI Creation Workflow

48. Workflow should be completely automated
Instantiate Configure
AMI Creation Workflow
Bake

49. Workflow should be completely automated
Instantiate Configure
AMI Creation Workflow
Bake Instantiate

50. Workflow should be completely automated
Instantiate Configure
AMI Creation Workflow
Bake Instantiate Test

51. Workflow should be completely automated
Instantiate DestroyConfigure
AMI Creation Workflow
Bake Instantiate Test

52. AMI Creation

53. AMI Creation

54. AMI Creation

55. aws.amazon.com/architecture : Web application hosting

56. Instances tend to drift from the known good state, monitoring key files & processes is important
AMI Instance

57. Instances tend to drift from the known good state, monitoring key files & processes is important
AMI Instance

58. Instances tend to drift from the known good state, monitoring key files & processes is important
AMI Instance
AlertIntegrity Monitoring

59. Integrity Monitoring

60. Integrity Monitoring

61. Integrity Monitoring

62. Keys
Respond
Review configuration
Apply intrusion prevention
Repair
Patch vulnerability in new AMI
Leverage integrity monitoring

63. Keys
Automation

64. aws.trendmicro.com
Canberra