In this session, we discuss the contention between traditional network security practices and the agile development processes typically associated with cloud computing. We also introduce new approaches used by Fortinet customers that help cloud teams and security teams share a common language and secure their business more effectively—without introducing additional friction and operational overhead.

1. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
Integrating Network and API Security into
Application Lifecycle
Lior Cohen
Sr. Director, Cloud Security
Fortinet
S e s s i o n I D

2. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
The Evolution of Application Architectures
Mainframe
Presentation
Business Logic
Data
Modular Applications
Hypervisor
Virtualized Applications Private Cloud
V
M

3. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
The Role of The Perimeter
Inside Outside

4. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
Threats vectors and Risk in the cloud
Public Cloud
V
M

5. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
Agile, Devops, Security and The Cloud

6. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
Biggest Gaps Seen by DevOps
DevOps Security Solutions in Place
Open Source: 58% of DevOps
teams make extensive use of
open source code; half plan to
expand their use
Strengths
• Security Analysis
• Security Scanning
Gaps
• Misconfigurations
• Compliance Monitoring
and Management
Source: The State of DevOps Security Survey, Fortinet, Q2 2019

7. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
Do DevOps work together with SecOps
Source: Protecting DevOps without Impeding Speed Webinar, Fortinet, ,May-29-2019

8. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
Laying Out a Secure Cloud Adoption Strategy
Private Data Center
Security-policyFortiAnalyzer FortiManager
1. Existing Private Datacenter Estate
2. Initial Cloud Rollouts
3. Deployment of
Security in The Cloud
4. Consistent: Security Posture,
Operational model
5. Confidently Increase cloud footprint

9. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
Some Things Never Change
Information
Classification
•define “how”
and “for what”
data is being
used
Roles and
responsibilities
•define who
and what
processes
need to access
which data
Least privilege
•make sure no
one has access
beyond what
he needs

10. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
data center
Amazon API
Gateway*
Amazon
WorkSpaces
FortiWeb Auto
Scaling
FortiGate Auto
Scaling
Cloud Services Hub
Amazon
Inspector
Amazon
Macie
flow logs
Protected Services and
Resources
Transit GW
AWS Security Hub
FortiMailFortiSandbox
High Speed IPSec VPN
AWS WAF
FortiCASB-Cloud
Fabric Connector
instances
Containers
FortiWeb
Containers
VPC
AWS Cloud
VPC
Amazon
GuardDuty
•Metadata based Policies
•Web & API Security
•Cloud Security Management
•Centralized Visibility

11. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
Tags, Labels & Metadata for Data classification
The Developer The Security Guy
prod_app [X]
dev_app [Y]

12. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
ConsistentSecurity with Fortinet Fabric Connectors
VPC3 VPC4
V
M
V
M
prod_appdev_app
VPC1 VPC2
V
M
V
M
prod_appdev_app
security-policy
prod_app [X]
dev_app [Y]
…
Public/Private
Cloud
Public/Private
Cloud
AWS EKS:
* k8s_cluster: Name of Kubernetes cluster.
* k8s_namespace: Namespace of a Kubernetes service or pod.
* k8s_servicename: Name of a Kubernetes service.
* k8s_nodename: Name of a Kubernetes node.
* k8s_zone: Zone of a Kubernetes node.
* k8s_region: Region of a Kubernetes node.
* k8s_podname: Name of a Kubernetes pod.
* k8s_label.xxx: Name of label of a Kubernetes resource
(cluster/service/node/Pod)
Collected IP addresses will include:
1. External IPs of exposed Kubernetes services
2. Both internal IPs and external IPs of Kubernetes nodes.
3. Pod IP addresses.

13. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
Web,API’sUsage andSecurity– FortiWeb& AWSWAF Rules
Why Web Security?
Cloud Services:
API Gateway
Lambda Functions
Cloud Management
Web Applications
Mobile Backend Applications
MiddleWare API’s
JSON Protection (Schema & Protocol)
XML/SOAP Protection (Schema, Protocol, Entities)
OpenAPI Schema
The API Gateway Ruleset defends against attacks that
target the AWS API Gateway and through that your back
end applications.

14. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
SOLUTION
• Configuration assessments and risk analysis
• Remediation action
• Actionable alerts
Cloud SecurityManagement with FortiCASB-Cloud
BENEFITS
• Reduce risk with central visibility and control
• Prioritize your risk management workflows
KEY CAPABILITIES
• Predefined & Custom assessment policies
• Intuitive drill down options to drive resolution
of risk

15. © 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
Protecting The Cloud, Web Applications, API’s and
Network
Public Cloud
V
M
FortiGate FortiWeb
FortiCASB
FortiAnalyzer

16. Thank you!
© 2019,Amazon Web Services, Inc. or its affiliates. All rights reserved.
Lior Cohen @LiorLive
www.fortinet.com/aws