AWS Edge Security - Cloud-Native Defense Against Diverse Internet Threats
•Transferir como PPTX, PDF•
2 gostaram•1,196 visualizações
Learn how you can defend your applications on AWS against diverse set of Internet threats, like DDoS, Bots or Zero-day attacks. At this session you will learn about how your applications on AWS are inherently secured against common threats. You will also learn about how you can use AWS security services like AWS WAF, Shield and Firewall Manager to build a robust and customised protection specific to your applications.
Recomendados
Recomendados
Mais conteúdo relacionado
Mais procurados
Mais procurados (20)
Semelhante a AWS Edge Security - Cloud-Native Defense Against Diverse Internet Threats
Semelhante a AWS Edge Security - Cloud-Native Defense Against Diverse Internet Threats (20)
Mais de Amazon Web Services
Mais de Amazon Web Services (20)
AWS Edge Security - Cloud-Native Defense Against Diverse Internet Threats
- 1. © 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Andrew Thomas, GM, AWS Perimeter Protection March, 2019 AWS Edge Security Cloud-Native Defense Against Diverse Internet Threats
- 2. © 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Goal • Learn about today’s threat landscape and how these threats can affect your application availability • Learn how easily using AWS services can give you baseline protections • Learn how AWS’s perimeter security services can provide additional application protections, without the need to re-architect
- 3. © 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved.© 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Overview of Threat Landscape
- 4. © 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Typical web applications Dynamic applications Personalized Content Static assets API Data CenterEnd Users
- 5. © 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Web application design considerations Data Center End Users Dynamic applications Personalized Content Static assets API
- 6. © 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Web application design considerations Data Center End Users DDoS Web Exploits Bots • Security • Authentication • Encryption (TLS) • Layered Protection • Availability • Resiliency/Fault Tolerance • Request handling capacity • Blocking bad traffic • Performance • Routing • Throttling • Alerting & Monitoring Dynamic applications Personalized Content Static assets API
- 7. © 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Types of threats that exist today SQL Injection Cross-site Scripting (XSS) OWASP Top 10 Common Vulnerabilities and Exposures (CVE) HTTP Floods Reflection Attack Crawlers Content Scrapers Scanners & Probes Denial of Service App Vulnerabilities Bad Bots
- 8. © 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Common DDoS attacks SYN Flood UDP Flood ICMP Flood Other Reflection Vectors HTTP Flood DNS Query Flood
- 9. © 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved.© 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Building the Baseline Defense
- 10. © 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Building blocks for baseline defense Amazon VPC Amazon CloudFront Amazon Route 53 Security Groups Network ACLs Global Presence SSL/TLS Origin Shielding Resilience (TTL) DNS Header Validations Good vs. Bad Resolvers Priority Based Traffic Shaping
- 11. © 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Benefits of the AWS Global Edge Network High Availability Application Acceleration AWS Integration Cost Effective
- 12. © 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved.© 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Leveraging AWS Perimeter Protection Services
- 13. © 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved. What else can we do to… • Defend against DDoS attacks? • Prevent exploits and bots at application level? • Manage and apply security policies across multiple accounts in an organization?
- 14. © 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Four tenets of AWS Shield for DDoS protection Frictionless setup with minimal architectural changes Low Operational Overhead for known and edge cases Visibility for dynamic security and compliance Protection from economic vectors AWS Shield
- 15. © 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Benefits of AWS Shield Standard and Shield Advanced Built-in DDoS Protection for Everyone Point and Protect Wizard Low Operational Overhead for known and edge cases Visibility for dynamic security and compliance Protection from economic vectors AWS Shield
- 16. © 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Benefits of AWS Shield Standard and Shield Advanced Automatic Protection across customers Enhanced Protection baselined to you 24x7 access to DDoS Response Team (DRT) Built-in DDoS Protection for Everyone Point and Protect Wizard Visibility for dynamic security and compliance Protection from economic vectors AWS Shield
- 17. © 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Benefits of AWS Shield Standard and Shield Advanced Automatic Protection across customers Enhanced Protection baselined to you 24x7 access to DDoS Response Team (DRT) Built-in DDoS Protection for Everyone Point and Protect Wizard Protection from economic vectors AWS Shield Cloud- Watch Metrics Attack Diagnostics Global Threat Environment Dashboard Quarterly Security Review
- 18. © 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Benefits of AWS Shield Standard and Shield Advanced Automatic Protection across customers Enhanced Protection baselined to you 24x7 access to DDoS Response Team (DRT) Built-in DDoS Protection for Everyone Point and Protect Wizard Cloud- Watch Metrics Attack Diagnostics Global Threat Environment Dashboard Quarterly Security Review AWS WAF at no additional cost For protected resources AWS Firewall Manager at no additional cost Cost Protection for scaling AWS Shield
- 19. © 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Application Level Protection with AWS WAF Automate using AWS Lambda based security automations Utilize Managed Rules from the AWS Marketplace for hassle free protection and deployment Customize security to your applications using custom rules Monitor using Amazon CloudWatch metrics or third-party log processorsAWS WAF
- 20. © 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Deploying AWS WAF is easy Amazon CloudFront AWS Application Load Balancer Amazon API Gateway
- 21. © 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Regional availability of AWS WAF and AWS Shield Advanced • N. Virginia (us-east-1) • Ohio (us-east-2) • Oregon (us-west-2) • N. California (us-west-1) • Ireland (eu-west-1) • Frankfurt (eu-central-1) • Tokyo (ap-northeast-1) • Sydney (ap-southeast-2)
- 22. © 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Regional availability of AWS WAF and AWS Shield Advanced • N. Virginia (us-east-1) • Ohio (us-east-2) • Oregon (us-west-2) • N. California (us-west-1) • Ireland (eu-west-1) • Frankfurt (eu-central-1) • Tokyo (ap-northeast-1) • Sydney (ap-southeast-2) • London (eu-west-2) • Stockholm (eu-north-1) • Singapore (ap-southeast-1) • Seoul (ap-northeast-2) NEW!
- 23. © 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Tools available within AWS WAF • SQL Injection Conditions • XSS Conditions • AWS CloudFormation based Security Automation • AWS Marketplace Managed Rules WebTraffic Filtering • Rate-based Rules • IP-Match & Geo-IP Filters • Regex & String Match Conditions • Size Constraint Conditions Visibility and Debugging • Amazon CloudWatch Metrics and Alarms • Sampled Logs • Comprehensive Logging Malicious Traffic Blocking
- 24. © 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Managed Rules for AWS WAF • Rules written, updated and managed by security experts • Pay as you go; available through AWS Marketplace • Choice of protections: • OWASP Top 10 & General Web Exploits • Common Vulnerabilities and Exposures (CVE) • Bot Protection • IP Reputation lists • CMS (e.g. Wordpress, Joomla) • Webservers (e.g. Apache, Nginx)
- 25. © 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Security automations using AWS WAF
- 26. © 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Security automations using AWS WAF
- 27. © 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Amazon GuardDuty and AWS WAF integration
- 28. © 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved. AWS Firewall Manager Ensure Compliance to Mandatory Rules Across Organization Simplify Management of Rules Across Accounts & Applications Enable Rapid Response to Attacks AcrossAllAccounts AWS Firewall Manager
- 29. © 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Regional availability of AWS Firewall Manager • N. Virginia (us-east-1) • Ohio (us-east-2) • Oregon (us-west-2) • Ireland (eu-west-1) • Frankfurt (eu-central-1) • Tokyo (ap-northeast-1) • Sydney (ap-southeast-2)
- 30. © 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Key benefits for AWS Firewall Manager Integrated with AWS Organizations so you can enable AWS WAF rules across multiple AWS accounts. Firewall Manager Policies can span across Accounts and across resources. Supports Hierarchical rules - Security administrator can create organization-wide rules, while delegating application-specific rules to individual Account owners. Simplify Firewall Rules Management Across Accounts & Resources
- 31. © 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Key benefits for AWS Firewall Manager Ensure Compliance of Existing and New Applications Ensure All your resources comply with a mandatory set of security policies Automatically discover new Accounts, or resources like ALB or CloudFront distribution as they are created Easily block traffic from embargoed countries across your Organization to adhere to the US Dept. of Treasury’s Office of Foreign Assets Control (OFAC) regulations
- 32. © 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved. AWS Firewall Manager Key Benefits Security administrator have a single console to receive real-time threats, and respond within minutes Quickly apply CVE Patches across all applications in your Organization, or block malicious IP addresses detected by GuardDuty across entire Organization Enable Rapid Response to Internet Attacks GuardDuty CloudWatch Events Lambda Amazon GuardDuty Amazon CloudWatch CloudWatch Event Lambda Function AWS Lambda Firewall Manager Account 2 Account 3 Account 1 AWS WAF
- 33. © 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved.© 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Thank You!
Notas do Editor
- Learn how you can defend your applications on AWS against diverse set of Internet threats, like DDoS, Bots or Zero-day attacks. At this session you will learn about how your applications on AWS are inherently secured against common threats. You will also learn about how you can use AWS security services like AWS WAF, Shield and Firewall Manager to build a robust and customised protection specific to your applications.
- A simple on-premise based solution. Maybe mention that a lot of people rely on security through obscurity?
- There are tons of attacks you need to think about, and these leads into bunch of challenging design considerations.
- There are tons of attacks you need to think about, and these leads into bunch of challenging design considerations.
- A good Web Application Firewall should help you quickly set fundamental protections, customize them to your applications and help you easily visualize your actions so you can create a dynamic security posture.
- Pointing out the the benefits of AWS WAF. Perhaps rename title?
- This is animated (arrow) Call out more on API Gateway, our recent launch.
- This is animated (arrow) Call out more on API Gateway, our recent launch.
- This is animated (arrow) Call out more on API Gateway, our recent launch.
- This is animated (by verticals) Talk about how these tools can help build solution to deal with bad bots and app vulnerabilities. Mention how we have OWASP and CVE protection from managed rules. Also our own OWASP whitepaper.
- https://aws.amazon.com/answers/security/aws-waf-security-automations/ Configuring a web application firewall strategy can be challenging and burdensome to large and small organizations alike, especially for those who do not have dedicated security teams. To simplify this process, we offer Security Automations solution which provides fine-grained control over the requests attempting to access your web application.
- https://aws.amazon.com/answers/security/aws-waf-security-automations/ Configuring a web application firewall strategy can be challenging and burdensome to large and small organizations alike, especially for those who do not have dedicated security teams. To simplify this process, we offer Security Automations solution which provides fine-grained control over the requests attempting to access your web application.
- https://aws.amazon.com/blogs/security/how-to-use-amazon-guardduty-and-aws-web-application-firewall-to-automatically-block-suspicious-hosts/ How to use Amazon GuardDuty and AWS Web Application Firewall to automatically block suspicious hosts 1. A GuardDuty finding is raised with suspected malicious activity. 2. A CloudWatch Event is configured to filter for GuardDuty Finding type. 3. A Lambda function is invoked by the CloudWatch Event and parses the GuardDuty finding. 4. State data for blocked hosts is stored in Amazon DynamoDB table. The Lambda function checks the state table for existing host entry. 5. The Lambda function creates a Rule inside AWS WAF and in a VPC NACL. 6. A notification email is sent via Amazon Simple Notification Service (SNS).
- Simplified Management of WAF Rules Integrated with AWS Organizations Centrally managed global rules and account-specific rules Ensure Compliance to WAF Rules Ensure entire Organization adheres to mandatory set of rules Apply protection even when new Accounts or resources are created Central Visibility Across Organization Central visibility of WAF threats across Organization Compliance Dashboard for audit firewall status An organization’s InfoSec team learns and operates WAF instead of each Account owner
- This is animated (arrow) Call out more on API Gateway, our recent launch.